d1cdcbbc64ef4818d55470a0f725c4d570cf39c4563fda078c00adae20d8bd98

Analysis

max time kernel
146s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 19:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe
Size 2.6MB
Sample260907-xy925sstat
SHA256 d1cdcbbc64ef4818d55470a0f725c4d570cf39c4563fda078c00adae20d8bd98
MD5 6884f5bb2de80dba0925ac1330d42d91
SHA1 8dc8089d5a58ed6537b5e63d19cab9df5a217c3b
SHA512 c365188340128a6a94183cc9479f2a823cc1c8cc3542fda23c8e9ce34a03646feecb07584c4aa5b3c68d12261eca807f14087813fc2297dd468147eb661a6625
SSDEEP 49152:OENwzIR257BjIqR6FoKvku04YLz0g7mM+M6RkMkIM7I067:OgwkQ79IqMDTM+M6RkMkIM7
TLSH
T151C57C10B7408028FAF612B15ABEE27C95297DB08B9850CFB1D977FE59352E12D3364B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Program crash 64 IoCs

pid	pid_target	Process
25204	6768	WerFault.exe
23432	4492	WerFault.exe
25188	2524	WerFault.exe
25172	5004	WerFault.exe
25156	4496	WerFault.exe
25164	4528	WerFault.exe
25668	3092	WerFault.exe
25508	6316	WerFault.exe
25500	6824	WerFault.exe
25488	2956	WerFault.exe
25796	6572	WerFault.exe
25812	6536	WerFault.exe
23640	6472	WerFault.exe
23244	1264	WerFault.exe
19928	3564	WerFault.exe
20180	3956	WerFault.exe
20084	6376	WerFault.exe
19788	2628	WerFault.exe
19812	5284	WerFault.exe
19936	6556	WerFault.exe
21968	2260	WerFault.exe
25804	6416	WerFault.exe
25868	6632	WerFault.exe
25860	2876	WerFault.exe
25836	6228	WerFault.exe
25852	6004	WerFault.exe
25840	3088	WerFault.exe
25828	668	WerFault.exe
25884	6236	WerFault.exe
25876	6600	WerFault.exe
25892	6276	WerFault.exe
25624	1420	WerFault.exe
25820	5924	WerFault.exe
25916	7140	WerFault.exe
25788	6732	WerFault.exe
25780	3028	WerFault.exe
25772	6088	WerFault.exe
39036	5620	WerFault.exe
39412	9728	WerFault.exe
39404	2208	WerFault.exe
39792	9820	WerFault.exe
39784	8676	WerFault.exe
39776	8452	WerFault.exe
39768	5640	WerFault.exe
39760	9756	WerFault.exe
39736	9736	WerFault.exe
39840	9832	WerFault.exe
39800	9748	WerFault.exe
39856	3168	WerFault.exe
39940	13156	WerFault.exe
8068	12264	WerFault.exe
39212	13140	WerFault.exe
39924	8408	WerFault.exe
39948	13056	WerFault.exe
39932	12996	WerFault.exe
40020	8424	WerFault.exe
40012	13088	WerFault.exe
39916	876	WerFault.exe
39904	12520	WerFault.exe
39896	124	WerFault.exe
39828	7244	WerFault.exe
39824	13184	WerFault.exe
39748	9828	WerFault.exe
39704	8128	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
1⤵
PID:4660
- C:\USBMonitorSrv.exe
  /i
  2⤵
  PID:5480
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4252
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3160
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6120
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1088
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8004
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16580
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16592
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16608
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16616
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16640
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16648
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16656
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16696
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16732
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16748
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16784
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16792
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:16812
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:17460
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:17512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:17520
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:17528
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:17536
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:17544
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:17556
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:17564
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:17572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:17580
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:17588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18656
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18696
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18768
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18776
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18784
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18792
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18808
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18832
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18840
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18848
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18856
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18964
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:18996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:19008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:19016
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:19024
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:20392
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:20400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:20408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21344
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21352
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21360
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21368
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21376
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21384
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21392
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21416
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21424
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21436
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21444
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21456
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21468
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21476
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21484
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21496
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21516
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21524
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21536
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21544
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21552
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21560
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21568
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21576
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21584
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21592
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21608
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21616
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21640
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21648
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21656
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21696
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21768
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21776
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21784
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21792
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21808
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21848
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21856
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:21868
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23224
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23256
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23276
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23284
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23296
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23304
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23316
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23324
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23336
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23344
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23352
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23360
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23368
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23376
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23384
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23392
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23416
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23424
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23448
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23460
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23468
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23480
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23500
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23520
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23532
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23540
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23560
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23580
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23592
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23612
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23648
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23656
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23668
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23676
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23696
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23748
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23768
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23776
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23784
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23792
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23812
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23820
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23828
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23836
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23848
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23856
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23904
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23920
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23936
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23944
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23952
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23960
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:23988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24000
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24012
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24024
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24032
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24056
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24068
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24076
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24088
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24112
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24120
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24144
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24152
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24160
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24168
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24176
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24184
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24192
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24200
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24208
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24216
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24224
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24232
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24240
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24248
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24256
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24268
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24276
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24288
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24300
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24312
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24324
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24332
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24344
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24356
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24368
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24376
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24388
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24412
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24424
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24432
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24464
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24472
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24484
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24500
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24524
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24532
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24544
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24556
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24564
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6028
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1056
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24596
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24604
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24616
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24640
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24648
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24656
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24696
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24756
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24768
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24776
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24792
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24808
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24832
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24840
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24848
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24856
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24904
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24924
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24940
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24952
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24964
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:24988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:25000
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:25012
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:25044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:25068
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:25084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:25092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:25100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:25108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:29796
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33580
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33596
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33604
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33612
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33620
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33628
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33640
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33648
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33656
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33696
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33768
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33776
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33784
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:28012
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:29616
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33808
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33832
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33840
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33848
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33856
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33908
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33924
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33940
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33964
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:33996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34004
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34012
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34020
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34028
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34052
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34068
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34076
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34116
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34124
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34140
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34156
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34172
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34188
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34196
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34204
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34212
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34220
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34228
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34244
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34252
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34260
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34268
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34276
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34284
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34292
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34300
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34308
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34316
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34324
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34332
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34348
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34356
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34372
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34380
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34388
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34396
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34404
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34412
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34420
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34428
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34436
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34444
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34460
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34468
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34476
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34484
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34500
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34516
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34524
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34532
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34540
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34548
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34556
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34564
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34580
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34596
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34604
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34612
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34620
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34628
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34636
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34644
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34652
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34660
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34668
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34676
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34684
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34724
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34732
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34740
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34748
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34756
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34764
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34772
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34780
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34796
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34812
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34820
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34828
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34836
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34852
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34860
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34868
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34876
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34884
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34892
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34900
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34908
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34924
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34940
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34964
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:34996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35004
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35012
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35020
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35028
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35052
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35068
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35076
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35116
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35124
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35140
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35156
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35172
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35188
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35196
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35204
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35212
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35220
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35228
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35244
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35252
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35260
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35268
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35276
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35284
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35292
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35300
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35308
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35316
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35324
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35332
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35348
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35356
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35372
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35380
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35388
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35396
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35404
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35412
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35420
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35428
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35436
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35444
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35460
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35468
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35476
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35484
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35500
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35516
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35524
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35532
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35540
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35548
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35556
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35564
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35580
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35596
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35604
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35612
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35620
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35628
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35636
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35644
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35652
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35660
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35668
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35676
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35684
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35724
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35732
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35740
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35748
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35756
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35764
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35772
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35780
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35796
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35812
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35820
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35828
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35836
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35848
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35856
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35904
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35920
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35964
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:35996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36004
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36012
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36020
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36028
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36052
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36068
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36076
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36116
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36124
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36140
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36156
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36172
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36188
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36196
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36204
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36216
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36224
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36232
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36240
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36252
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36260
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36268
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36276
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36284
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36292
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36304
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36312
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36320
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36328
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36336
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36344
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36352
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36360
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36368
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36380
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36388
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36396
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36416
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36424
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36432
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36460
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36468
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36476
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36488
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36496
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36504
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36520
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36528
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36540
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36548
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36556
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36564
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36580
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36596
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36604
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36612
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36620
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36628
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36636
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36644
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36652
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36660
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36668
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36676
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36684
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36724
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36732
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36740
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36748
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36756
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36764
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36772
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36780
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36796
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36812
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36820
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36828
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36836
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36852
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36860
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36904
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36920
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36936
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36944
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36952
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36960
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36976
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36984
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:36992
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:37000
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:37008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:37016
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:37024
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:37032
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:37040
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:37048
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:37056
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:37064
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:37072
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:37080
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:37088
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:37096
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:37104
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:37112
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:37992
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40188
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40724
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40732
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40740
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40748
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40756
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40764
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40772
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40780
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40796
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40812
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40820
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40828
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40836
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40852
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40860
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40868
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40876
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40884
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40892
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40900
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40908
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40924
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40940
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:40956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:42724
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:44360
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45648
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45656
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45696
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45768
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45776
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45784
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45792
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45812
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45820
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45828
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45836
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45852
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45860
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45868
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45876
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45884
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45892
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45900
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45908
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45924
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45940
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45964
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:45996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46004
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46012
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46020
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46028
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46052
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46068
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46096
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46124
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46140
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46156
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46172
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46188
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46196
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46204
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46212
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46220
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46228
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46244
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46252
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46260
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46268
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46276
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46284
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46292
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46300
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46308
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46316
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46324
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46332
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46348
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46356
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6884f5bb2de80dba0925ac1330d42d91_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:46372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 7140 -ip 7140
1⤵
PID:12128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2904 -ip 2904
1⤵
PID:12232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 6004 -ip 6004
1⤵
PID:15976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 556 -ip 556
1⤵
PID:17448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 3956 -ip 3956
1⤵
PID:17504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 6536 -ip 6536
1⤵
PID:18012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 280
1⤵
- Program crash
PID:21968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6556 -s 280
1⤵
- Program crash
PID:19936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5284 -s 280
1⤵
- Program crash
PID:19812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 280
1⤵
- Program crash
PID:19788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6376 -s 280
1⤵
- Program crash
PID:20084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 280
1⤵
- Program crash
PID:20180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6140 -ip 6140
1⤵
PID:20092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 280
1⤵
- Program crash
PID:19928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 280
1⤵
- Program crash
PID:23244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6472 -s 280
1⤵
- Program crash
PID:23640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 280
1⤵
- Program crash
PID:25156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 280
1⤵
- Program crash
PID:25172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 280
1⤵
- Program crash
PID:25188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 280
1⤵
- Program crash
PID:23432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6768 -s 280
1⤵
- Program crash
PID:25204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 280
1⤵
- Program crash
PID:25488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6824 -s 280
1⤵
- Program crash
PID:25500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6316 -s 280
1⤵
- Program crash
PID:25508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 3564 -ip 3564
1⤵
PID:25516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 280
1⤵
- Program crash
PID:25164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1088 -p 6824 -ip 6824
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 280
1⤵
- Program crash
PID:25668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1080 -p 6164 -ip 6164
1⤵
PID:25900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6536 -s 280
1⤵
- Program crash
PID:25812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6572 -s 280
1⤵
- Program crash
PID:25796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 280
1⤵
- Program crash
PID:25772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 280
1⤵
- Program crash
PID:25780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6732 -s 280
1⤵
- Program crash
PID:25788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 6416 -ip 6416
1⤵
PID:25908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 284
1⤵
- Program crash
PID:25916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 280
1⤵
- Program crash
PID:25820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 280
1⤵
- Program crash
PID:25624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1060 -p 6556 -ip 6556
1⤵
PID:25608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6276 -s 280
1⤵
- Program crash
PID:25892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6600 -s 280
1⤵
- Program crash
PID:25876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 3964 -ip 3964
1⤵
PID:26488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6416 -s 280
1⤵
- Program crash
PID:25804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6236 -s 280
1⤵
- Program crash
PID:25884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 280
1⤵
- Program crash
PID:25828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 280
1⤵
- Program crash
PID:25840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6004 -s 280
1⤵
- Program crash
PID:25852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6228 -s 280
1⤵
- Program crash
PID:25836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 280
1⤵
- Program crash
PID:25860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 280
1⤵
- Program crash
PID:25868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1100 -p 668 -ip 668
1⤵
PID:8304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1136 -p 6228 -ip 6228
1⤵
PID:26928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1128 -p 6564 -ip 6564
1⤵
PID:27012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1184 -p 2660 -ip 2660
1⤵
PID:27312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1200 -p 6300 -ip 6300
1⤵
PID:27356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1204 -p 6376 -ip 6376
1⤵
PID:27524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1124 -p 5924 -ip 5924
1⤵
PID:27576

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:27640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1220 -p 3596 -ip 3596
1⤵
PID:12080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1244 -p 6572 -ip 6572
1⤵
PID:27912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1188 -p 6732 -ip 6732
1⤵
PID:27968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1288 -p 3088 -ip 3088
1⤵
PID:28044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1312 -p 6472 -ip 6472
1⤵
PID:37156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1304 -p 2524 -ip 2524
1⤵
PID:33544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1344 -p 2468 -ip 2468
1⤵
PID:37700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1320 -p 6600 -ip 6600
1⤵
PID:37708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1364 -p 6752 -ip 6752
1⤵
PID:38072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1384 -p 5076 -ip 5076
1⤵
PID:38184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1400 -p 4492 -ip 4492
1⤵
PID:38500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1416 -p 6520 -ip 6520
1⤵
PID:38576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1420 -p 6804 -ip 6804
1⤵
PID:38924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 280
1⤵
- Program crash
PID:39036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5104 -ip 5104
1⤵
PID:39044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5284 -ip 5284
1⤵
PID:39116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 280
1⤵
- Program crash
PID:39404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9728 -s 280
1⤵
- Program crash
PID:39412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1480 -p 2628 -ip 2628
1⤵
PID:39432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9880 -s 280
1⤵
PID:39420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1500 -p 4528 -ip 4528
1⤵
PID:39604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9844 -s 280
1⤵
PID:39648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9752 -s 280
1⤵
PID:39656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7188 -s 280
1⤵
PID:39664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8740 -s 280
1⤵
PID:39672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7796 -s 280
1⤵
PID:39680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 284
1⤵
PID:39688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8436 -s 280
1⤵
PID:39696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8128 -s 280
1⤵
- Program crash
PID:39704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9828 -s 280
1⤵
- Program crash
PID:39748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9756 -s 284
1⤵
- Program crash
PID:39760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 284
1⤵
- Program crash
PID:39768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8452 -s 280
1⤵
- Program crash
PID:39776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8676 -s 300
1⤵
- Program crash
PID:39784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9820 -s 280
1⤵
- Program crash
PID:39792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1496 -p 4264 -ip 4264
1⤵
PID:39624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13184 -s 280
1⤵
- Program crash
PID:39824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7244 -s 284
1⤵
- Program crash
PID:39828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9748 -s 292
1⤵
- Program crash
PID:39800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9832 -s 280
1⤵
- Program crash
PID:39840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9736 -s 296
1⤵
- Program crash
PID:39736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 124 -s 280
1⤵
- Program crash
PID:39896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 12520 -s 280
1⤵
- Program crash
PID:39904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 284
1⤵
- Program crash
PID:39916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8408 -s 284
1⤵
- Program crash
PID:39924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13140 -s 280
1⤵
- Program crash
PID:39212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 12264 -s 284
1⤵
- Program crash
PID:8068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13156 -s 280
1⤵
- Program crash
PID:39940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 284
1⤵
- Program crash
PID:39856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13088 -s 280
1⤵
- Program crash
PID:40012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8424 -s 284
1⤵
- Program crash
PID:40020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 12996 -s 280
1⤵
- Program crash
PID:39932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13056 -s 280
1⤵
- Program crash
PID:39948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4496 -ip 4496
1⤵
PID:40004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1420 -ip 1420
1⤵
PID:40076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13012 -s 296
1⤵
PID:40196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13148 -s 280
1⤵
PID:40204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8428 -s 280
1⤵
PID:40404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9084 -s 280
1⤵
PID:40412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 12552 -s 280
1⤵
PID:40440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7216 -s 280
1⤵
PID:40448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8952 -s 280
1⤵
PID:40456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 12464 -s 236
1⤵
PID:40464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9792 -s 280
1⤵
PID:40472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 280
1⤵
PID:40480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13040 -s 280
1⤵
PID:40488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Daemon.exe

Path C:\Daemon.exe
Size 454KB
SHA256 484ff8ea8e6ccc3d31671636fd05d0a3ec2642499dda7138f3d8b0b8c753320f
MD5 ec0b7c9826979a5be56d7d4b062d748a
SHA1 5e22683becb46ca2547434b555279c5164bea16e
SHA512 054795373253e418d5434e93f16f327cdb4c092375bbb9c0f0eb4a8a3585c6d359e244db10da60fad60f7934ef1f11b58af0b726d98438383f7ce8f0abd4dd44
SSDEEP 6144:G7JJY5Hebd8Rr6FoYpD6Ws0la8CFt4X8/nClI1ayhmzkq:WJY5HmqRr6FoYpDan8q+86lIEj
TLSH
T191A438016A60C029F3B673F46A6EE168945D7DB04768A4CFE1E57AF986301F26C3325F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempfile

Path C:\Users\Admin\AppData\Local\Temp\tempfile
Size 2.5MB
SHA256 166ccd1bde5ede3ca1a11f4bd5f772df76c593c651d8dd8f8b00a7c465bc27d2
MD5 1e593cba61733655a1b36b0ae2e2475a
SHA1 90d8c58554e1ef062f0c59490e22ce378efeac3e
SHA512 cea230d96978f2678d9e7b1e4a3a6ce0e02b009c4f2b5974bee2ea7c463d806722ec66e6427146ac2cc6f6b62555614e24e89dd246953d169c99f91f5ca87ce3
SSDEEP 49152:MENwzIR257BwIqR6FoKvku04YLfPji0Aj:MgwkQ76IqMDQjo
TLSH
T157C55B10F7608024F9B391F58AEAE2ACE5293CB0476890CBA1C5B7FD5A366E15D33357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tempfile

Path C:\Users\Admin\AppData\Local\Temp\tempfile
Size 2.9MB
SHA256 3ad5eae7839c727b1ede18f89e530976fa7aa1923f5cd278427958efca805d35
MD5 0f98d80aa7b54fcdee4c50016e1f81c2
SHA1 faa5ea65b6e783c4a572a807d02727d7dedc73f5
SHA512 3b19a02e82ebf3b6fbae1ffcd247ca91de84a26928fb10cc92423bd35131d034e227fecca7baf7a9fdb6f0d27a71e8d493f998c75d67057c1a675ecf7472e574
SSDEEP 49152:tENwzIR257BUIqR6FoKvku04YL0/ezSC6vUzPvMHjy:tgwkQ7OIqMDFezSC6v2XMH
TLSH
T1D2E54B10F6708126F5F391F5CAEAA2ACE9353CA1472440CB61C6B7FD1A366E15D3232B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host.exe

Path C:\Windows\SysWOW64\host.exe
Size 657KB
SHA256 e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875
MD5 c613e69c3b191bb02c7a191741a1d024
SHA1 1962888198ae972cbb999d0dc9c9ee5cbabf5e0d
SHA512 76a4b04af54db1f3ac64230720b7754deb61cf2418cdf928224bea5eecf647c33249490979336ec027a46176d0262e0f016deec20380221a5d005ae4c2fb3914
SSDEEP 12288:PPX+pd167QhE0s7+jM+M6ugRfMMkIM7ovX+pd167QhE0u7+YN:HE6Ehg7mM+M6RkMkIM7gE6Eh67F
TLSH
T135E49D42F3C1F4A5D4A946705A77DB341667FD6998184B2F32A8B65F2C303837836E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.log

Path C:\service.log
Size 277B
SHA256 8183a9b49527fff08267d1b6f20909f7f6e3236b25098b3b416945fdc383e9dd
MD5 c4db6f3c0f177c9d0d5a4de52006be6f
SHA1 4b6830bccae3774efdd21438d6a4a6e8d621675b
SHA512 a5f7185b8e183bb9746ad0cefc0b12472724fce97c32c6c4ba791cfaec17a08019d25bf6d94257e8d3656e9e87a0026dd0e710aed1c91f3f2ec351a8f353d0c7
TLSH
T165D05E4516C846F7C6C7292A8E8323C5CE0B312D183CF49283FA3E5920DBE0D702C653
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1040-278-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/2876-250-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/4660-0-0x0000000000430000-0x000000000071C000-memory.dmp

Download

memory/4660-1-0x0000000000542000-0x0000000000543000-memory.dmp

Download

memory/4780-303-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/5524-224-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/6116-241-0x0000000000400000-0x000000000049C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads