Analysis
- max time kernel
149s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/09/2026, 10:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
General
- Target 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe
- Size 2.0MB
- Sample260903-mrcsys1wbw
- SHA256 8f896322a6372e8fac48d911be032d4eeefbdc4ad933db8db026ef969617c667
- MD5 6690f67e26d1cee3e9bd8488afc68633
- SHA1 eec198b7d2d633c2a1fc4062bd8c335a25fc7628
- SHA512 d6b3d22ee55e6089b8fff42c88e753960e03668f1cabc905b1bb884a8bc57678af13d626a8a92074d64c474266fa3b36094f5c24be36ee6d126a60abb6e08f13
- SSDEEP 24576:SENJKEt6dq8hXj8R2vxW870KHNe5GqR6FokG81Cvz44sLy0aZJQ5Te6Lwai:SENwzIR257BMIqR6FoRvku04YL
- TLSH T1E5A53A10AB508029FAF752F55AADE1BC951C7DF0879860CBA1D577FA46362F02D3328B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 600 USBMonitorSrv.exe 4280 Daemon.exe 4332 Daemon.exe 4148 Daemon.exe 5376 Daemon.exe 2728 Daemon.exe 3176 Daemon.exe 3192 Daemon.exe 2180 Daemon.exe 2276 Daemon.exe 3076 Daemon.exe 5760 Daemon.exe 3352 Daemon.exe 1408 Daemon.exe 2484 Daemon.exe 2536 Daemon.exe 3532 Daemon.exe 2600 Daemon.exe 3276 Daemon.exe 6116 Daemon.exe 3556 Daemon.exe 3580 Daemon.exe 4648 Daemon.exe 1244 Daemon.exe 5836 Daemon.exe 2500 Daemon.exe 5972 Daemon.exe 5224 Daemon.exe 4132 Daemon.exe 1160 Daemon.exe 5468 Daemon.exe 5688 Daemon.exe 3444 Daemon.exe 2876 Daemon.exe 3248 Daemon.exe 1832 Daemon.exe 4564 Daemon.exe 1740 Daemon.exe 3020 Daemon.exe 3268 Daemon.exe 2252 Daemon.exe 816 Daemon.exe 5248 Daemon.exe 1908 Daemon.exe 4892 Daemon.exe 1964 Daemon.exe 1464 Daemon.exe 264 Daemon.exe 240 Daemon.exe 1344 Daemon.exe 4368 Daemon.exe 3288 Daemon.exe 1448 Daemon.exe 1404 Daemon.exe 3508 Daemon.exe 3216 Daemon.exe 4432 Daemon.exe 2400 Daemon.exe 2188 Daemon.exe 3892 Daemon.exe 1188 Daemon.exe 4080 Daemon.exe 680 Daemon.exe 2924 Daemon.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\copied.exe yyzUSB.exe File created C:\Windows\SysWOW64\host.exe yyzUSB.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender\MpDlpService.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender\mpextms.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USBMonitorSrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USBMonitorSrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yyzUSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Daemon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Daemon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Daemon.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 800 wrote to memory of 600 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 88 PID 800 wrote to memory of 4280 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 89 PID 800 wrote to memory of 4332 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 91 PID 800 wrote to memory of 4148 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 92 PID 800 wrote to memory of 5376 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 93 PID 800 wrote to memory of 2728 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 94 PID 800 wrote to memory of 3176 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 95 PID 800 wrote to memory of 3192 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 96 PID 800 wrote to memory of 2180 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 97 PID 800 wrote to memory of 2276 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 98 PID 800 wrote to memory of 3076 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 99 PID 800 wrote to memory of 5760 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 100 PID 800 wrote to memory of 3352 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 101 PID 800 wrote to memory of 1408 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 102 PID 800 wrote to memory of 2484 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 103 PID 800 wrote to memory of 2536 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 104 PID 800 wrote to memory of 3532 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 105 PID 800 wrote to memory of 2600 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 106 PID 800 wrote to memory of 3276 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 107 PID 800 wrote to memory of 6116 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 108 PID 800 wrote to memory of 3556 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 109 PID 800 wrote to memory of 3580 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 110 PID 800 wrote to memory of 4648 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 111 PID 800 wrote to memory of 1244 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 112 PID 800 wrote to memory of 5836 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 113 PID 800 wrote to memory of 2500 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 114 PID 800 wrote to memory of 5972 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 115 PID 800 wrote to memory of 5224 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 116 PID 800 wrote to memory of 4132 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 117 PID 800 wrote to memory of 1160 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 118 PID 800 wrote to memory of 5468 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 119 PID 800 wrote to memory of 5688 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 120 PID 800 wrote to memory of 3444 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 121 PID 800 wrote to memory of 2876 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 122 PID 800 wrote to memory of 3248 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 123 PID 800 wrote to memory of 1832 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 124 PID 800 wrote to memory of 4564 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 125 PID 800 wrote to memory of 1740 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 126 PID 800 wrote to memory of 3020 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 127 PID 800 wrote to memory of 1272 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 128 PID 800 wrote to memory of 3268 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 129 PID 800 wrote to memory of 816 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 130 PID 800 wrote to memory of 2252 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 131 PID 800 wrote to memory of 5248 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 132 PID 800 wrote to memory of 1908 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 133 PID 800 wrote to memory of 4892 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 134 PID 800 wrote to memory of 1464 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 135 PID 800 wrote to memory of 1964 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 136 PID 800 wrote to memory of 264 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 137 PID 800 wrote to memory of 240 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 138 PID 800 wrote to memory of 1344 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 139 PID 800 wrote to memory of 4368 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 140 PID 800 wrote to memory of 3288 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 141 PID 800 wrote to memory of 4136 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 142 PID 800 wrote to memory of 1448 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 143 PID 800 wrote to memory of 3740 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 144 PID 800 wrote to memory of 1520 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 145 PID 800 wrote to memory of 4288 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 146 PID 800 wrote to memory of 4840 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 147 PID 800 wrote to memory of 4076 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 148 PID 800 wrote to memory of 4160 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 149 PID 800 wrote to memory of 1376 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 150 PID 800 wrote to memory of 924 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 151 PID 800 wrote to memory of 6000 800 2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:800 -
C:\USBMonitorSrv.exe/i2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:600
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4280
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:4332
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:4148
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5376
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:2728
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:3176
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:3192
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:2180
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:2276
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:3076
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:5760
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:3352
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:1408
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:2484
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:2536
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:3532
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:2600
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:3276
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:6116
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:3556
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:3580
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:4648
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:1244
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:5836
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:2500
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:5972
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:5224
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:4132
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:1160
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:5468
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:5688
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:3444
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:2876
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:3248
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:1832
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:4564
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:1740
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:3020
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:1272
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:3268
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:816
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:2252
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:5248
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:1908
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:4892
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:1464
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:1964
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:264
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:240
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:1344
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:4368
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:3288
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:4136
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:1448
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:3740
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:1520
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:4288
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:4840
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:4076
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:4160
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:1376
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:924
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:6000
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:1680
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:5516
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:5560
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:1564
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:1404
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:636
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:3404
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:3508
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:3216
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:4432
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:2776
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:2400
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:2832
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:4956
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:1972
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:2188
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:4092
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:628
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:3188
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:3892
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:2692
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:1188
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:2848
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:1928
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:3412
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:2008
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:4268
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:1660
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:804
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:4080
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:1332
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:1208
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:680
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:1248
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵
- Executes dropped EXE
PID:2924
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:2064
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:5924
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:1980
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:2932
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:2860
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:4364
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:4828
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:5648
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:5116
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:5892
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:6136
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:2732
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:2796
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:4524
-
-
C:\Daemon.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6690f67e26d1cee3e9bd8488afc68633_amadey_elex_remcos_smoke-loader_wannacry.exe"2⤵PID:4232
-
-
C:\USBMonitorSrv.exeC:\USBMonitorSrv.exe1⤵
- System Location Discovery: System Language Discovery
PID:5080 -
C:\yyzUSB.exe"C:\yyzUSB.exe"2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5020 -
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:2856
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:4852
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:1348
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:3796
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:3168
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵
- System Location Discovery: System Language Discovery
PID:5364
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:5660
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:3376
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:2404
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:3720
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:3296
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:124
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:956
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:2984
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:2920
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:904
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:4636
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:2456
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:5384
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:4308
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:3136
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:5368
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:1560
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:2724
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:1212
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:5700
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:2088
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:4212
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:3384
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:5036
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:4832
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:1800
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:2868
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:1528
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:4484
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:1620
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:5664
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:4700
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:5964
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:2260
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:3664
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:3128
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:2512
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:1088
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:4992
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:5548
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:236
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:5992
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:2852
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:1416
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:5580
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:1080
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:2636
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6064
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:5832
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:5096
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:4788
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:1320
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6148
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6156
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6164
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6172
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6180
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6188
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6196
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6204
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6212
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6220
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6228
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6236
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6244
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6252
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6260
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6268
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6276
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6284
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6292
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6300
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6308
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6316
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6324
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6332
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6340
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6348
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6356
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6364
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6372
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6380
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6388
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6396
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6404
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6412
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6420
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6428
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6436
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6444
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6452
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6460
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6468
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6476
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6484
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6492
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6500
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6508
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6516
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6524
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6532
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6540
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6548
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6556
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6564
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6572
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6580
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6588
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6596
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6604
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6612
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6620
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6628
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6636
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6644
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6652
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6660
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6668
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6676
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6684
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6692
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6700
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6708
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6716
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6724
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6732
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6740
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6748
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6756
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6764
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6772
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6780
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6788
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6796
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6804
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6812
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6820
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6828
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6836
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6844
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6852
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6860
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6868
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6876
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6884
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6892
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6900
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6908
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6916
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6924
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6932
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6940
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6948
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6956
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6964
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6972
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6980
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6988
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:6996
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7004
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7012
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7020
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7028
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7036
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7044
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7052
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7060
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7068
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7076
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7084
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7092
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7100
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7108
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7116
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7124
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7132
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7140
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7148
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7156
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7164
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7176
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7184
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7192
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7200
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7208
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7216
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7224
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7232
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7240
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7248
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7256
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7264
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7272
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7280
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7288
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7296
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7304
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7312
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7320
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7328
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7336
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7344
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7352
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7360
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7368
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7376
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7384
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7392
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7400
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7408
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7416
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7424
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7432
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7440
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7448
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7456
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7464
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7472
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7480
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7488
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7496
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7504
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7512
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7520
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7528
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7536
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7544
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7552
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7560
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7568
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7576
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7584
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7592
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7600
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7608
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7616
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7624
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7632
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7640
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7648
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7656
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7664
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7672
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7680
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7688
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7696
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7704
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7712
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7720
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7728
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7736
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7744
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7752
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7760
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7768
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7776
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7784
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7792
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7800
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7808
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7816
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7824
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7832
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7840
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7848
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7856
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7864
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7872
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7880
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7888
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7896
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7904
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7912
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7920
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7928
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7936
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7944
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7952
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7960
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7968
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7976
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7984
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:7992
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8000
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8008
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8016
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8024
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8032
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8040
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8048
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8056
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8064
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8072
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8080
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8088
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8096
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8104
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8112
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8120
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8128
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8136
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8144
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8152
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8160
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8168
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8176
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8184
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8196
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8204
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8212
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8220
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8228
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8236
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8244
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8252
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8260
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8268
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8276
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8284
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8292
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8300
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8308
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8316
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8324
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8332
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8340
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8348
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8356
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8364
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8372
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8380
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8388
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8396
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8404
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8412
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8420
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8428
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8436
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8444
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8452
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8460
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8468
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8476
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8484
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8492
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8500
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8508
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8516
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8524
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8532
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8540
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8548
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8556
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8564
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8572
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8580
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8588
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8596
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8604
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8612
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8620
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8628
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8636
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8644
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8652
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8660
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8668
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8676
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8684
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8692
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8700
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8708
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8716
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8724
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8732
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8740
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8748
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8756
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8764
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8772
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8780
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8788
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8796
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8804
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8812
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8820
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8828
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8836
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8844
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8852
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8860
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8868
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8876
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8884
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8892
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8900
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8908
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8916
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8924
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8932
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8940
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8948
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8956
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8964
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8972
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8980
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8988
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:8996
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9004
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9012
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9020
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9028
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9036
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9044
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9052
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9060
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9068
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9076
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9084
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9092
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9100
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9108
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9116
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9124
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9132
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9140
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9148
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9156
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9164
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9172
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9180
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9188
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9196
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9204
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9212
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9224
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9232
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9240
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9248
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9256
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9264
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9272
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9280
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9288
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9296
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9304
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9312
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9320
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9328
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9336
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9344
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9352
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9360
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9368
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9376
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9384
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9392
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9400
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9408
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9416
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9424
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9432
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9440
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9448
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9456
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9464
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9472
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9480
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9488
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9496
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9504
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9512
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9520
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9528
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9536
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9544
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9552
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9560
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9568
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9576
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9584
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9592
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9600
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9608
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9616
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9624
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9632
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9640
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9648
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9656
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9664
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9672
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9680
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9688
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9696
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9704
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9712
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9720
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9728
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9736
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9744
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9752
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9760
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9768
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9776
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9784
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9792
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9800
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9808
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9816
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9824
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9832
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9840
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9848
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9856
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9864
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9872
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9880
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9888
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9896
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9904
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9912
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9920
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9928
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9936
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9944
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9952
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9960
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9968
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9976
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9984
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:9992
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10000
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10008
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10016
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10024
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10032
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10048
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10056
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10064
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10072
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10080
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10088
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10096
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10104
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10112
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10120
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10128
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10136
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10144
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10152
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10160
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10168
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10176
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10184
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10192
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10200
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10208
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10216
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10224
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10232
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:4568
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10248
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10256
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10264
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10272
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10280
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10288
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10296
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10304
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10312
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10320
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10328
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10336
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10344
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10352
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10360
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10368
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10376
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10384
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10392
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10400
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10408
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10416
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10424
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10432
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10440
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10448
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10456
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10464
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10472
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10480
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10488
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10496
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10504
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10512
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10520
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10528
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10536
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10544
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10552
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10560
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10568
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10576
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10584
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10592
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10600
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10608
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10616
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10624
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10632
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10640
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10648
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10656
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10664
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10672
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10680
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10688
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10696
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10704
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10712
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10720
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10728
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10736
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10744
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10752
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10760
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10768
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10776
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10784
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10792
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10800
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10808
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10816
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10824
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10832
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10840
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10848
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10856
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10864
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10872
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10880
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10888
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10896
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10904
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10912
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10920
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10928
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10936
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10944
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10952
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10960
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10968
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10976
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10984
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:10992
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11000
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11008
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11016
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11024
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11032
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11040
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11048
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11056
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11064
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11072
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11080
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11088
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11096
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11104
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11112
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11120
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11128
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11136
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11144
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11152
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11160
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11168
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11176
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11184
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11192
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11200
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11208
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11216
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11224
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11232
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11240
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11248
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11256
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:4120
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11268
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11276
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11284
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11292
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11300
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11308
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11316
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11324
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11332
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11340
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11348
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11356
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11364
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11372
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11380
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11388
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11396
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11404
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11412
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11420
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11428
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11436
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11444
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11452
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11460
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11468
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11476
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11484
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11492
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11500
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11508
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11516
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11524
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11532
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11540
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11548
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11556
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11564
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11572
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11580
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11588
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11596
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11604
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11612
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11620
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11628
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11636
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11644
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11652
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11660
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11668
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11676
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11684
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11692
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11700
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11708
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11716
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11724
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11732
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11740
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11748
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11756
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11764
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11772
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11780
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11788
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11796
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11804
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11812
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11820
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11828
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11836
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11844
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11852
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11860
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11868
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11876
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11948
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11956
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11964
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11972
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11980
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11988
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:11996
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12004
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12012
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12020
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12028
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12036
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12044
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12052
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12060
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12068
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12076
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12084
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12092
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12100
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12108
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12116
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12124
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12132
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12140
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12148
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12156
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12164
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12172
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12180
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12188
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12196
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12204
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12212
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12220
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12228
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12236
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12244
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12252
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12260
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12268
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12276
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12284
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:432
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:4028
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:4496
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:2480
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:2768
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:3164
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:3828
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:3272
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:4500
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:4300
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:3172
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:2516
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12292
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12300
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12308
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12316
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12324
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12332
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12348
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12356
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12364
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12372
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12380
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12388
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12396
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12404
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12412
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12420
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12428
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12436
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12444
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12452
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12460
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12468
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12476
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12484
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12492
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12500
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12508
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12520
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12528
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12536
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12544
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12584
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12592
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12600
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12608
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12616
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12624
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12632
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12640
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12648
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12656
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12664
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12672
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12680
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12688
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12696
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12704
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12712
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12720
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12728
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12736
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12744
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12752
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12760
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12768
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12776
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12784
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12792
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12800
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12808
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12816
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12824
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12832
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12840
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12848
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12856
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12864
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12872
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12880
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12888
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12896
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12904
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12912
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12920
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12928
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12936
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12944
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12952
-
-
C:\Daemon.exe"C:\yyzUSB.exe"3⤵PID:12960
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Daemon.exe
- Size 454KB
- SHA256 1d4a9e19b470570cf52676d3cad4dfb8880e7fba83df9a034792677c2f4c8e32
- MD5 6175b5dc639ebb11fc708a67b4e7a3e3
- SHA1 d8f5a80e548ec700cfa0b85293ea15e8b4141e8c
- SHA512 8653c2fd4107cf636fca88446ce6bdc3262ad61376eb464096e2d1bf48d2b807c4e09c98fcd5a070f296d0e1314f8d8b3e439ec70697d3198a5f962e750b4007
- SSDEEP 6144:G7JJY5Hebd8Rr6FoYpD6Ws0la8CFt4X8/nClI1wyhmz1q:WJY5HmqRr6FoYpDan8q+86lIyI
- TLSH T1D2A438016A60C029F3B673F46A6EE168945D7DB04768A4CFE1E57AF986301F26C3325F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\USBMonitorSrv.exe
- Size 694KB
- SHA256 f92c2d3b3f1df60b6401f697a05bd3e200a824a9aa2cc84a021963c911987c20
- MD5 9ac3dc0ce15644d39b039527d942685c
- SHA1 a08e14954fd47f58eeec36e9942a12557066c7d1
- SHA512 360d31a9e66802a18610c8688be17c3bbf762db62c0f36a1b20477d42648bacbd8a0d50a54d05f1745fbb576c87878716242bdc2e7b81dff276e592d37182522
- SSDEEP 12288:GHtTeTvIchy4LoLtlG8ZtwJ0ofJ2/5v7nL9Hwn6Lz:gCvz44sLy0aZJQ5Te6L
- TLSH T10FE45A10BB518429FDF751F54AFEA17C952C79B0DB9C20CB60C953EA463A6F02E36287
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.0MB
- SHA256 bc8e04549da86e7b906d50eb98270cbeb5a7b224cac303c1899aa3be98a71c1c
- MD5 3284119e73913887fedefd9e6eccba2f
- SHA1 0f42963e03f06519c34327e0d5d65e575b4d8bed
- SHA512 98296ad18574305d1fd68c7e1a4d4be9b19539837b049539017d580d31bba573eb9cdb798459e4e0a3e0816a279bcb6da74445048c4972f8a7262786ec3717b8
- SSDEEP 24576:sENJKEt6dq8hXj8R2vxW870KHYe5GqR6FokG81Cvz44sLy0aZJQ5Te6LbE:sENwzIR257B7IqR6FoRvku04YLb
- TLSH T160A54A10AB508029FAF752F55AADE1BC951C7DF0879860CBA1D577FA46362F02D3328B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.5MB
- SHA256 b0f9ce53f8ca02fe78209ea87af68615cd85a521b15b845436c32cda4ad026d7
- MD5 0384ba06dd3ca7c1653bc7bf20918f13
- SHA1 04f0c0b2b271f9a85fcb154e2c9ddebd3ace09e6
- SHA512 a28b33f6f0199901eee610bf42fdf3f4df7f0937065e78be449efb9c7a1f2e78e4e208c71348879b1455e38ef414fb6ae2a7f62100232b7a8fad3db43abbf8b8
- SSDEEP 49152:MENwzIR257BwIqR6FoRvku04YLmPji0Aj:MgwkQ76IqMefjo
- TLSH T124C55B10F7608024F9B391F58AEAE2ACE5293CB0476890CBA1C5B7FD5A366E15D33357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.9MB
- SHA256 238d89c25ca322089c20cf4e4b27f25e80e512947ad44dca39a28dd4d1586d11
- MD5 6e2e00dc4984904702ef14121c3f52aa
- SHA1 5469fd46a68828331139fed2dd072fcfe8baa2b8
- SHA512 9e157bbd02875b0693aa3bb17463fe8d07fea53d4a0db26251c73d54e40568c90398c1d29f7746308e9782e3a76bcd84fb27faaa3f39985c5375cfd536565882
- SSDEEP 49152:tENwzIR257BUIqR6FoRvku04YLp/ezSC6vUzPvMHjy:tgwkQ7OIqMeYezSC6v2XMH
- TLSH T1E0E54B10F6708126F5F391F5CAEAA2ACE9353CA1476440CB51C6B7FD2A366E15D3232B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.3MB
- SHA256 caf85da6c43329154d79b758911857cb9c9d1f86759d56b572edb5bb43341b42
- MD5 b3c7f5cd606b69e068a3ce738fc79a85
- SHA1 7af064dfb8c1602397fc8f480d73e9dc5b865798
- SHA512 d96c29158a69979f9f1c690ff295719e58db592eed32a9fe57fc2a3f6b3adbd9d03b51c57eab202f3a6cc6d99ca62501ba7284fd077e7eb6573f32cf0edc61d0
- SSDEEP 24576:CENJKEt6dq8hXj8R2vxW870KHMe5GqR6FokG81Cvz44sLy0aZJQ5Te6LzaewsAjY:CENwzIR257BPIqR6FoRvku04YLmlj
- TLSH T11DB54B20BB50C029FAF712F55ABDE268942D7DB08B9860CBB1D976FE45352E12D33247
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.6MB
- SHA256 1417ed5e394b287a8e217b20b39cfc1f2b1b18c8053a5514c20a69111a1ee608
- MD5 7138cd90438e34199c622a900f8d722f
- SHA1 d8c32aa8429b69fd6b1488d38840fe69aa0ffacf
- SHA512 c3b1345c1e1a13721f824d97e82b4494e1f6a45c1866397f5c334d1993b17cb18e68e8dec4e777589a0d0b490500a3b99ce8a526f5e601c9e9919ae5da939cce
- SSDEEP 49152:XENwzIR257BsIqR6FoRvku04YLuVO88hXl+:XgwkQ7+IqMec/h1+
- TLSH T187D55B10F7608025F5B391B58AEAE1ACE9393CB0876490CB61C5B7FD1A366E16D33367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.0MB
- SHA256 8f896322a6372e8fac48d911be032d4eeefbdc4ad933db8db026ef969617c667
- MD5 6690f67e26d1cee3e9bd8488afc68633
- SHA1 eec198b7d2d633c2a1fc4062bd8c335a25fc7628
- SHA512 d6b3d22ee55e6089b8fff42c88e753960e03668f1cabc905b1bb884a8bc57678af13d626a8a92074d64c474266fa3b36094f5c24be36ee6d126a60abb6e08f13
- SSDEEP 24576:SENJKEt6dq8hXj8R2vxW870KHNe5GqR6FokG81Cvz44sLy0aZJQ5Te6Lwai:SENwzIR257BMIqR6FoRvku04YL
- TLSH T1E5A53A10AB508029FAF752F55AADE1BC951C7DF0879860CBA1D577FA46362F02D3328B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.1MB
- SHA256 bae747037391f0614004531249473b8916cf7645f71bbe6ce790e46f8556a6d0
- MD5 4029a1e2a7b3e1772d1fbbd5cef4ea93
- SHA1 cab77bebf9b3ced96a0127536521f54027100148
- SHA512 1903d3a469661a76c4a1f06bc4bd8a87b0f06670ef9154b8c3190910f4c39088918a084e37923e4bdef78a130bf851050414d54468120db00883216000e2f194
- SSDEEP 24576:EENJKEt6dq8hXj8R2vxW870KHke5GqR6FokG81Cvz44sLy0aZJQ5Te6LPB:EENwzIR257BnIqR6FoRvku04YL
- TLSH T189A53A10E7508028FAEE52B5CBADE168B51B7DB087D860CBA1D5F6FE47352E02D72247
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.2MB
- SHA256 eba7c345e2c22270cdb5f8c8736910a825c981d33a0151584a3bcb11e3476196
- MD5 15df3fa6b2d4dc4438a17dd621926d29
- SHA1 65a211d4d622cef47d0800313bebf21862a4c9f3
- SHA512 0b54d5ec551ed94ddbdaa3a7e21aca34ad732869579578754f5cb0f0263dc469eaaf2aea22f4292c3ec87ae78638202b9c1ac6bc6256565d1b7a9ad032ba425f
- SSDEEP 24576:rENJKEt6dq8hXj8R2vxW870KHpe5GqR6FokG81Cvz44sLy0aZJQ5Te6L3wukOWb:rENwzIR257BIIqR6FoRvku04YL3w7O
- TLSH T148B55B10B7508029FAF752B54AAEE17CA52D7DB08798A0CBA1D577FA46362F02D33347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 5.0MB
- SHA256 bfe2d64ea9654b0e8b7d69fa378bbc9f22e9ac97b5539ca3b69cb512efacd2bd
- MD5 ed9e19ae91ff58830d861476899cc23a
- SHA1 990d42909eb2ac8b3e02bdd50d7c532eeee08274
- SHA512 0028ab5ea8782dc73f1eecad7c4384e6acc74c218fcb6ba821544b436918429e461c5717a8559b6d4871a69f4f707ce0e9d27a7d096a6e75ba9ac218f9b5e6e3
- SSDEEP 49152:9ENwzIR257BZIqR6FoRvku04YLiyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0W:9gwkQ73IqMe6m7vj1BDlZ
- TLSH T1D0369E13F29140D8F4AAD1B5879ED235E525BCA0472461CF12D0BBE62B77BE02F3A716
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 3.4MB
- SHA256 56f5595cb4e6ac2f1f883e4e91a260550d6f536f156e45c127c4a78b17d5c52e
- MD5 c203f3aef0359e64a8842d098c985ddb
- SHA1 f970f84658bb45c2032ea6d3d448fecd5a23c003
- SHA512 b708c3e8e855f537d42f4574c743860e2e4057af56abc826038f9e7cdb8977cc3ea1c22f18d45fcd8f3794f088ad121a4b24eff6edb87c7f9aedf3dc7754e16d
- SSDEEP 49152:EENwzIR257BVIqR6FoRvku04YLDhtSn8EApI0fig1giDn0AP5w:EgwkQ7LIqMelX2iwph
- TLSH T121F58D12F79040A8F4AAD1B58BAED178E5297CB04B6860CF51D477EA1A377F02E36347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.0MB
- SHA256 f4a793e810d98e5ba86cf2b6b046d2df66020da1017071dcb1ef1df0a30dd85d
- MD5 1b7d890173eb6452b69189bf7c586fc6
- SHA1 314d92217459666184c75f3eb6bebb7baad61071
- SHA512 da28579ff67da57469c5681850b10cdb02cc9607d53721f966c39fba9356af13501418e96a39464141bf2b9549ae0babd83fe59a344756313b63cfa33bdbcf68
- SSDEEP 24576:bENJKEt6dq8hXj8R2vxW870KHse5GqR6FokG81Cvz44sLy0aZJQ5Te6Lre:bENwzIR257BvIqR6FoRvku04YL
- TLSH T1FFA53A10AB508029FAE752F55AADE1BC951C7DF0879860CBB1D577FA46362F02D3328B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.0MB
- SHA256 c5d793473ae462929dd10788d7ca5381a20f1d5ee5681ac4ea2f04b7c1f7411d
- MD5 30eaf9931e00047e7dbf40b0e615fd6a
- SHA1 a9d88fa15fcb67ba9a61435b251f2254164b0053
- SHA512 4fe2896a81e896aab56e932d27fd8cdcfa3881ee9fba228f83b922e5c462d5b7ff69e0e59378c24e2790bbe6b981afe69072a7591e62b808d11bf1e7c324cc15
- SSDEEP 24576:gENJKEt6dq8hXj8R2vxW870KHYe5GqR6FokG81Cvz44sLy0aZJQ5Te6LSa:gENwzIR257B7IqR6FoRvku04YL
- TLSH T1F4A54A10AB508028FAE752F55AADE1BC951C7DF0879860CBB1D577FA46366F02D3328B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.0MB
- SHA256 6d56e25dbe4ffb95453709af901314b6d58c3a243e51613c2416dbcf50255541
- MD5 4142a9fc2e2538f251079aaf81dcc2a5
- SHA1 033627ec3c7f295ded684a2cd659a1e2ec6bf511
- SHA512 5689dd782074fb9893c2fb06ee2ea7d49dfbd5c0a5ba07fa929b93cab8089aaf6e5ecb65719d351605ffd207d28727c0e4076e9c7605d31db3666acf3a767687
- SSDEEP 24576:oENJKEt6dq8hXj8R2vxW870KHoe5GqR6FokG81Cvz44sLy0aZJQ5Te6L8:oENwzIR257BrIqR6FoRvku04YL
- TLSH T1C0A53A10AB508029FAF752F55AADE1BC951C7DF0879860CBA1D577FA46362F02D3328B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.2MB
- SHA256 b0a4afd13b709df02afb772ab8c6e45bc47ddccefe853c7bf31ce0021aae2d13
- MD5 c438b86910af642d7b15461cfdda90e0
- SHA1 f7f11db255d68fc8f8b8cbfa94abeed5acc36794
- SHA512 92afed6223eaea5c675d0347bfd1d89da6be2ba9fedbce70e05cd46673b7f4715330ec61781936675079f7256943894c16e18f6969b5ff7089cd806565343334
- SSDEEP 24576:sENJKEt6dq8hXj8R2vxW870KHwe5GqR6FokG81Cvz44sLy0aZJQ5Te6LYXYfDtcm:sENwzIR257BTIqR6FoRvku04YLPtc
- TLSH T1EBB55B10B7508028FEF752F55AADE16C95297CF08798A0CBA1D577FA4A362E02D37387
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.1MB
- SHA256 cc1ebd6e78432b36ddea09acac12b458593d3cf6ca6c43e6af57885c6a46ed98
- MD5 1b16331aa13ac9ca3928d23dfa9ad970
- SHA1 86e29eddba7a0c08bf67d7b358f0d7f9073d6d61
- SHA512 d0b2b1b2b5370adaa1b9dfced9156d5e1ea6315bc403ab0c88ec04aa33931af3cfb7b926a0625fd66479a4fbbed0cc21073894f72c76f0a5b749d83da45125e2
- SSDEEP 24576:vENJKEt6dq8hXj8R2vxW870KHee5GqR6FokG81Cvz44sLy0aZJQ5Te6LlT6mpv:vENwzIR257BBIqR6FoRvku04YLlTPp
- TLSH T15CA54B10AB508029FAF752B55ABDE17C952C7DF08B9860CBB1D577F946362E02D3328B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.5MB
- SHA256 85619f3b25728c63b4fa2c7528a0889fd52499f2e1648a823d48a824b1053fef
- MD5 764ee9f1e341979bbef9cf660ad3ea50
- SHA1 04ea708c6c7d1035b5b8dfae5c7112d7f6369d8c
- SHA512 e2f12c14fca85286aa852a28594aa5d6c30802aad10d4dc5888b736cb0a3d2a51c686f4ba69a52f140142198e966b799525bdb29b1c54bd1cc845a5cef1c838a
- SSDEEP 49152:XENwzIR257B7IqR6FoRvku04YLydNXhn4:XgwkQ7FIqMeJHn4
- TLSH T12BC57D10FB518028FAE781F54AAEE178A4297CF0476860CBB1D577FA5A356F02E36347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.0MB
- SHA256 f13f4988bdb5e648ebc33d6f4deca659b48d58bdfa30667de40e3938aab7b715
- MD5 f68c1e7a29a1c1750d068cbfc7693c61
- SHA1 1d1ff57253180f762c359fe1a81e66c2f6274c02
- SHA512 1f10c68f2e97fff0a370c545a09a4ac9281f78be7b4561d882933490b081bffbba86487ce0dc84f09719d67f1101cb22f2ab9a6035c58c355a1a5b93fa334ac6
- SSDEEP 24576:PENJKEt6dq8hXj8R2vxW870KHce5GqR6FokG81Cvz44sLy0aZJQ5Te6LBE:PENwzIR257B/IqR6FoRvku04YL
- TLSH T1E3A54A10AB508029FAE752F55AAEE1BC951C7DF0879860CBB1D577FA46362F02D33287
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.1MB
- SHA256 8f7b52a205ad403a8f6668a44cdb4a8f628f664ad998d715ff004a475561efd8
- MD5 8614214d3992225647234a20cc1bb52a
- SHA1 aa09b8ac3fb42afbdba6671b3395c1c4b1f065eb
- SHA512 659f0ec1ef645cabce45ec10160003e7f403de426cb0ad98d49a99abbbe44f4a06e01c4df034e750069681e14a677844b61ad93b99b285ada8fb995eddc2e088
- SSDEEP 24576:EENJKEt6dq8hXj8R2vxW870KHke5GqR6FokG81Cvz44sLy0aZJQ5Te6L06Iab:EENwzIR257BnIqR6FoRvku04YL06I
- TLSH T1CCA54A10BB508028FAE752F55AAEE17C952C7DF0879860CBA1D577FA46366F02D33287
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.0MB
- SHA256 dca774327636785cb334de76bddc46e1b123cc3f83d38ddc986791244471187d
- MD5 b4efa295ca7ed3e3aa8702f0e314c9aa
- SHA1 d9449debe7d952b913d23439a62f596eeb999d15
- SHA512 a8e189b8411fcebf2739863f7465a99e59d786c9abc2b389e594e96ae4e8689d32b839d2554f1276ae27901db9300f2a0dd1930b9c2e01b31fce7a7cef0f29a3
- SSDEEP 24576:FENJKEt6dq8hXj8R2vxW870KHfe5GqR6FokG81Cvz44sLy0aZJQ5Te6LNY:FENwzIR257B2IqR6FoRvku04YLN
- TLSH T1EBA54A10AB508028FAF762F55AADE1AC941C7DF08B9860CBA1D577FE46352F12D33297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.1MB
- SHA256 007c4115d8b20f98dd4b61777f3918228d069dc60b88b0435a754f24b6d2331a
- MD5 b2429e9b1be6e28917f54e225664a6f0
- SHA1 ba05e77ce7de58827ee31c5b3f83788f127ca28f
- SHA512 a42181653852258257baf4af9decffd5ee52a7064f8edc5f5753c769adb43e6bd9ad37a8a039dcf4c3af3718c567769a8ffef0a0c803fbffc356f04f14735e90
- SSDEEP 24576:CENJKEt6dq8hXj8R2vxW870KHAe5GqR6FokG81Cvz44sLy0aZJQ5Te6LAzye:CENwzIR257BDIqR6FoRvku04YLA
- TLSH T103A54A10B7508028FAF752F55AAEE1AC952D7DB0879860CBA1D577FA46362F02D33387
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.4MB
- SHA256 aa6e6a39d6bcd6062b17f2c0b2dde36cfcdc528e8780e36968f5c9b99719623f
- MD5 91385cf317828bc03941ad9880a338b2
- SHA1 5f68b9ca06d0638fabb40a2dcb96ba203a24861f
- SHA512 1968269ef5428d3e4414fb9ec063738ba7a1657626fbb4ad34c3f44566b55ac61f67e81b56efa3422b917817a014046d62666989471e0a847e0d1727dcbc9484
- SSDEEP 24576:LENJKEt6dq8hXj8R2vxW870KHoe5GqR6FokG81Cvz44sLy0aZJQ5Te6LLecLWREU:LENwzIR257BrIqR6FoRvku04YLJW+3
- TLSH T1F8C56B10B7508028FAF752F54AAEE16895297CF0879860CBB1D577FA5A362F02D37387
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.2MB
- SHA256 4de03a4aac28c680ef31b64519afa13c4519f2eafab5d69aa6472d1ba0646df9
- MD5 7db649aef058606765f47dbc87f9c646
- SHA1 a0d13c2e8c6d23a3f9d0850d77e8802cfbf2d78f
- SHA512 dc2b8bac4a881930a864919886685dd7ef84c5c71c1e9243370b6b5212c06e2c018b0c88d1f1edeb953ae05e14c77bb70520d7033f883aec572f0b032d7aed16
- SSDEEP 49152:VENwzIR257BjIqR6FoRvku04YLXT1Llj:VgwkQ7VIqMeULt
- TLSH T1BDB55B10B7508028FEF752B55AADE1AC95297CF0879890CBA1D577FA46362F02D3738B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.2MB
- SHA256 9ee3873d0729fe4520bf339723dade918ab8aa9db06ca7ac00df0da6884d0a70
- MD5 b991f28ae5ef8c79ae638c7c8447b93d
- SHA1 4793b9f0e731b16a27e737cbe6601a1f9adb6eed
- SHA512 80add75a760a3b92facbf0187b0fbbb7d2cb529f90d4d4eb9e8949faa096d8e7fa6711184670f0e38c3417b5035544ba53773c766aaf47542174f6c301a8e05d
- SSDEEP 24576:wENJKEt6dq8hXj8R2vxW870KHie5GqR6FokG81Cvz44sLy0aZJQ5Te6Lnu2w2JUy:wENwzIR257B1IqR6FoRvku04YLnO6
- TLSH T156B55C10B7508024FAE752F55AADE1B8A5297DF04B9860CBA1D5B7FE4A362F02D33347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 6.1MB
- SHA256 4a11c6ea7a0ba6e638a1a21c6bc3e0288c934ef987dd2109f5ae4a021da40188
- MD5 acad7d7584a55d58701e6d1cd5acede4
- SHA1 4cba3e4bf021be7dd7337e2c2a612f2be71b4b0b
- SHA512 324330f8df3e7386d37ba544182b9c94cbf1b695949322ec1e2a9b8b0fd6818158e9bddd84069f28650c150c3d5acf37de39e325cdae48d051308bda5bda4ee6
- SSDEEP 49152:WENwzIR257BgIqR6FoRvku04YL0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfovF:WgwkQ7aIqMejQvGAdlCEL8c/bRNw5C
- TLSH T113566C11ABA080F5F5B79174897AC5B5F6757C620B30A6CF0191E6AF2F336E01D3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 3.3MB
- SHA256 8872deb745d96de2b52b547af897162b90f661863ce4a4f19e92d7b452467889
- MD5 b3eddd551890f8f3eac6dc711741a95c
- SHA1 3034b5d59e0a35a6635cb0c22d0622ca113aa03b
- SHA512 3d2253d80290b8d34c0623986ce9fae65be0884b8bbfaea5b2b5db7892a049a672af47d97abfd68da56f37c10f26025718dabe2d90953ebbf928f5920fe8b5db
- SSDEEP 49152:uENwzIR257BJIqR6FoRvku04YLKTD8VSEov0Y1ooT:ugwkQ7PIqMelD8VSd0
- TLSH T1C2F57C10B750C425F9AB41B069FDE2695628BCF09B94D0EB72D9B3ED4A313E06D3634B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.2MB
- SHA256 b32401359196d86aebf8236e4255d8cded576aae90e6ee598af78f28fc4531fc
- MD5 25d2e539007154f3a1d67b21f739b5c1
- SHA1 435dc3aae96280c5e64c892d94f68a0bee1ef40a
- SHA512 4efcece78f52b650fbdf48a0a3e57451a48946490ed34da0b91fb83ffffde37d9e4a93f31fc2ab2e2e128cbde6c16259f167b7a3884097138bc13efe46550276
- SSDEEP 24576:yENJKEt6dq8hXj8R2vxW870KHoe5GqR6FokG81Cvz44sLy0aZJQ5Te6LJlqxz7BE:yENwzIR257BrIqR6FoRvku04YLnG9W
- TLSH T117B55B10AB508029FAE712F55AAEE1BC951C7DF0879860CBB1C577FA55366F02D3328B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.1MB
- SHA256 ce0061e39d088d7a62afca56bb5fd7ea04d4fceb5b06d4b3b2738194d76b5cb5
- MD5 6a809ba66ee86bdae57eb0dac93045ff
- SHA1 b9718fdbef660a8e9bac13ada0bcfe8cdc975f7b
- SHA512 884dc25fbadd5041e6310db56d031a7de7444be96cefb7700a0f29009a9e615bb2ea2e968ecd83f62f68edfd0790c96e97ff8f39cf59eca73f66cbfe9b9a2db8
- SSDEEP 24576:iENJKEt6dq8hXj8R2vxW870KHxe5GqR6FokG81Cvz44sLy0aZJQ5Te6Lgu0:iENwzIR257BwIqR6FoRvku04YLX
- TLSH T14EA55A10AB508028FAF752F55AAEE1BC951C7DF0879860CBA1D577FA56352F02D3328B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.9MB
- SHA256 33955d11a7376de8989dfb0f84835ee444338df757c0abf45b90c1b9867f29f9
- MD5 c4e805f5093bfe36a58c8ed9e21bdb0d
- SHA1 6fdaab6d315806ac9d2989d92b20b35fa9f468e7
- SHA512 4c551e9947a49c0b38cb6cfd415e1be2728064941c3b50ac4f1333c18fb80526fff5aa4e68b70c3b1952d207dbfe31a1a04329a09ed2f0a6ffa943f6e5180ea0
- SSDEEP 49152:vENwzIR257BEIqR6FoRvku04YL+xAibBEZ1LWtBzkO:vgwkQ7+IqMe5ZOA
- TLSH T1C5E57D12F7518068FABB81B04BAAD278A5287CB0472874CF65D5F7F61E31AE05E37346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 4.1MB
- SHA256 06112d6df83d716c7815f6e565d745fb9cd5fee620eb5f3a9f7ee2d277ffc1fa
- MD5 4dbd3168d2d9dc29b96b1d4c3edcbca0
- SHA1 2182027565808fa4d0bf997494bfc898c1476789
- SHA512 86d22fff3e71aaa7e30e08c880322a2a83be304d081801dd21c4336b38aa13950d42c6184bb09e77f061761329da984e4505b517d10fefd5873b9c2e4bc8d766
- SSDEEP 49152:nENwzIR257B9IqR6FoRvku04YL9CbRquA/m2yL5zbfFiV+XenmE3/z:ngwkQ7XIqMe5oq2Vjnm
- TLSH T12E167D11B760C064E5F7C3B84AAAC25AF2357C608B34A6DF519567EE1E33BE05D3A312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.2MB
- SHA256 514d8ab1599fb67c89642d43d23e14b695fb4b39fba9e804003068266460fb6e
- MD5 4c3c019ffc9eb9668531c80bb9d11a09
- SHA1 48609906e53654f42c62cbc562e20a571decf599
- SHA512 e07977837628f58838bf03627759d18b388eb1ea639bb6607cfb2123c4bbb680ca21def03ea453d72416a33431aa551843d998925e91e6826e0ae7608c644a74
- SSDEEP 24576:VENJKEt6dq8hXj8R2vxW870KH/e5GqR6FokG81Cvz44sLy0aZJQ5Te6LpJIU3:VENwzIR257BWIqR6FoRvku04YLpJIU
- TLSH T110B56C11BB108025FAF752F55AADE168962D7CB08B9860CBE1D577FE4A362F02D33247
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.2MB
- SHA256 c9be7221a1c4a0201cc9c74cff0afb6b466ab55a4cfab127209f2c1d24fee48e
- MD5 10b8dfa043dfba933091a69b271e75d0
- SHA1 fd0e8c358d88b2b9b7cd427b0adef49806e2f745
- SHA512 3b8728e36cbd116fb311e00c1fd0d940a0ef4752065b0e0f71787a53b376b1ea06f254368482971dbf5b26c131a3df408ae57ef9d4087c32c2379b82b6dcc5b7
- SSDEEP 49152:/ENwzIR257BDIqR6FoRvku04YLqC17Iw:/gwkQ7VIqMeW7Iw
- TLSH T18AB55B10A7508029FAF752F55AEEE1BC951C7DB0879860CBA0D577FA46366F02D3328B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.0MB
- SHA256 5699bcd0988a563c0a7a20c8c84c3b79f64d4961e4bbfa9d9afa4fc5f1b08dcb
- MD5 e84db9eb53c5098c283598eb8c6660f9
- SHA1 4357f2c7444232fbc6e220359bf350f1683b45dd
- SHA512 5b858eb13d46a8ecaac3a207a815f06940f0f629ee7cc9a4c5bc64984dfac730ad4128e0f5a614241f740a3238919ccbb4b3691ee3e0a4f0b83a4faa8b41cdaa
- SSDEEP 24576:oENJKEt6dq8hXj8R2vxW870KHFe5GqR6FokG81Cvz44sLy0aZJQ5Te6L6:oENwzIR257BkIqR6FoRvku04YL
- TLSH T1D7A53A10AB508029FAF752F55AADE1BC951C7DF0879860CBA1D577FA46362F02D3328B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.0MB
- SHA256 e3de682100373be0e3aacda3cb98768f8139051f886e91dac8cfcfb671be1ee6
- MD5 d4733042d223975c269b2e22d08f8fa8
- SHA1 ec4c55969ddcb6424c067322723762012b31bd4e
- SHA512 6d233e597e940e4215aa6a400908ea3e97025fb6e5507ccf0132f11ebbbb13a9ca5026e81611cf8a527388efcb0a0a80a7acaf990ec7288a8763cc31b26b744c
- SSDEEP 24576:bENJKEt6dq8hXj8R2vxW870KH5e5GqR6FokG81Cvz44sLy0aZJQ5Te6LRR:bENwzIR257B4IqR6FoRvku04YL
- TLSH T1BFA53A10AB508029FAE752F55AADE1BC951C7DF0879860CBB1D577FA46362F02D3328B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.1MB
- SHA256 3ea14d1c8313ce1af9c252aaf564c55a77ebca35609291a47f400118371c946a
- MD5 b82724d718a4bf67666ac31f2c110c7f
- SHA1 7f1846a69b07289a7c4d685f107f15d9250dfb48
- SHA512 3b16d117c9da03bdea55f41154ab076baffcb8f35563e547c8f92423169072dbb6dd6ad29e7c5e63b6c05fe136ee8d479c0f154a8b4054f01c103b0233ab7ada
- SSDEEP 24576:MENJKEt6dq8hXj8R2vxW870KH9e5GqR6FokG81Cvz44sLy0aZJQ5Te6LEI3Z:MENwzIR257BcIqR6FoRvku04YLE
- TLSH T176A53910A7508028FAF752F55ABDE1BC951D7DF08B9860CBA1D576FA46362F02D3328B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.2MB
- SHA256 147edf718ba8c35b967bb254360807804fbe0190a7bd46220b1d581d697789b2
- MD5 45c162207e523deb32bf3ce7c9137247
- SHA1 df45ffddfaef36a25203d3588c7a6644c0b5358f
- SHA512 a2765cab7fdf94092bb176f31167f7523fdf0a21e4df5852e1d8d09b7ed3538c4ef4b38f8b12a8ad5bb7727d8d0548d166329fa743a45f2e051bf169027ca043
- SSDEEP 49152:VENwzIR257BEIqR6FoRvku04YLLT1Llj:VgwkQ7uIqMe4Lt
- TLSH T1E1B55B10B7508028FEF752B55AADE1AC95297CF0879890CBA1D577FA46362F02D3738B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tempfile
- Size 2.1MB
- SHA256 f4d79fee4fee3613e59d09b0dfdf98477c02101723cd88f8d9d1eca83fa74792
- MD5 0521b43cbe0e8b08d8071ad122ea8d2d
- SHA1 0ece249672aef21365b4996fd8d4ff6c1c8ae4a4
- SHA512 8701435b374e2fb35bec08cdf87228260589c76ccf27a6c48c422e7a3476def9e80c24a90205a33600a5b067dd82a4c73baf78d64b5ed0483cbb3bc7b0642ea2
- SSDEEP 24576:/ENJKEt6dq8hXj8R2vxW870KHxe5GqR6FokG81Cvz44sLy0aZJQ5Te6LqHdfnQ:/ENwzIR257BwIqR6FoRvku04YL
- TLSH T165A55A10B7508028FAF752F55AADE1AC952D7DF08B9860CBA1D577FA46362F02D33287
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\host.exe
- Size 14KB
- SHA256 2ffa1c010889dc2c03dfef2271343ac6032c3966530c383b92d3dfd99a3aadc5
- MD5 5dfdda860ba69df0ae0ab193cf22a4ad
- SHA1 631c3b573b87688a9c5c5f9268fa826b315acb22
- SHA512 ba844e4157d1da80879d89d52155e10f02682f34d92a5a7a57fb1d723cac66b01ff3aace379072780c01720419fd21f1f25279f6587950e9ed4c43688c284a95
- SSDEEP 192:Qplw/Q3AjmqdD5KOEBrXJWRVkdQ2l+827nNHy+NXNUoynP+yJihMNV28d/o:ulgQ3655Kv1XIRV2Qi4Xax+yJ+MNH
- TLSH T1CA62D502CBA454E1FBFB0631B9FA298B5AB6BD104894DE1E47B07F9D0C34680E566357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\service.log
- Size 429B
- SHA256 2b267f855a8bf710d40d3543d19da8953ded005c4733bfd8943278d54d53cb9d
- MD5 c44b715c3e40735b032a7f92db82fe77
- SHA1 d93e9f99b8286a6e0736134dc50b4cbcff36986b
- SHA512 1741b86ddeeb0e80db35451c7361b8d9644d47b0450cbd97c0b1db54245893845bdb7e0ae75c938f7a956c79fbc6b85939df31a09e4ae2bb3ecdbf6e4032b5d2
- TLSH T1CEE0928524C817F7CAC32425AE972389DF5B32291C3DB49543FA3D1E30DBD0E646C696
- MD5 SHA1 SHA512 TLSH