89fbe46c1b2715cb9cfa6f62ad570a6292e7e31417db75f09277c41e72f69dca

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/10/2026, 23:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe
Size 2.8MB
Sample261004-3h299atvbw
SHA256 89fbe46c1b2715cb9cfa6f62ad570a6292e7e31417db75f09277c41e72f69dca
MD5 e6311417ca75f111456ed813a9a769b8
SHA1 7a9f09ebb15cab7a466bc3587a03c8e16ba630f1
SHA512 c7e9e14ffcecf3ea208a59bd227dcdd9dccb6576baecdbb0a523e9f282c943fa67eda7399cd9c96492026303f044a49ba8d7f26f145c940e35cb4a88709b1258
SSDEEP 49152:yENwzIR257BYIqR6FoRvku04YLPeW4SkZP4sz9Mb:ygwkQ7aIqMe2fkZc
TLSH
T166D54910F6608126F5F391B5CAEEA2ACF9353CA0476440CB61C9B7FD1A366E15D3236B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5020	USBMonitorSrv.exe
6012	host.exe
1420	Daemon.exe
4880	Daemon.exe
3348	Daemon.exe
4680	Daemon.exe
3344	Daemon.exe
4132	Daemon.exe
4804	Daemon.exe
5080	Daemon.exe
3664	Daemon.exe
1952	Daemon.exe
1992	Daemon.exe
3036	Daemon.exe
4584	Daemon.exe
4692	Daemon.exe
4676	Daemon.exe
4496	Daemon.exe
1888	Daemon.exe
4856	Daemon.exe
5964	Daemon.exe
5588	Daemon.exe
2584	Daemon.exe
1408	Daemon.exe
2360	Daemon.exe
5076	Daemon.exe
3644	Daemon.exe
2492	Daemon.exe
3120	Daemon.exe
2336	Daemon.exe
1472	Daemon.exe
4792	Daemon.exe
2864	Daemon.exe
2308	Daemon.exe
1668	Daemon.exe
4436	Daemon.exe
3388	Daemon.exe
1576	Daemon.exe
1136	Daemon.exe
1572	Daemon.exe
3016	Daemon.exe
4244	Daemon.exe
356	Daemon.exe
264	Daemon.exe
1072	Daemon.exe
240	Daemon.exe
2688	Daemon.exe
5888	Daemon.exe
5740	Daemon.exe
1492	Daemon.exe
6140	Daemon.exe
2704	Daemon.exe
6132	Daemon.exe
5280	Daemon.exe
5636	Daemon.exe
4424	Daemon.exe
5704	Daemon.exe
2416	Daemon.exe
1540	Daemon.exe
2936	Daemon.exe
5684	USBMonitorSrv.exe
5148	yyzUSB.exe
5756	Daemon.exe
2064	Daemon.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	host.exe
File created	C:\Windows\SysWOW64\copied.exe	yyzUSB.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	host.exe
File created	C:\Windows\SysWOW64\host.exe	yyzUSB.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	host.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBMonitorSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yyzUSB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBMonitorSrv.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	host.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6012	host.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	6012	host.exe
Token: 35	6012	host.exe
Token: SeRestorePrivilege	10212	host.exe
Token: 35	10212	host.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 5020	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	89
PID 4820 wrote to memory of 6012	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	91
PID 4820 wrote to memory of 1420	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	92
PID 4820 wrote to memory of 4880	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	93
PID 4820 wrote to memory of 3348	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	94
PID 4820 wrote to memory of 4680	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	95
PID 4820 wrote to memory of 3344	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	96
PID 4820 wrote to memory of 4132	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	97
PID 4820 wrote to memory of 4804	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	98
PID 4820 wrote to memory of 5080	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	99
PID 4820 wrote to memory of 3664	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	100
PID 4820 wrote to memory of 1952	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	101
PID 4820 wrote to memory of 1992	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	102
PID 4820 wrote to memory of 3036	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	103
PID 4820 wrote to memory of 4584	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	104
PID 4820 wrote to memory of 4692	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	105
PID 4820 wrote to memory of 4676	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	106
PID 4820 wrote to memory of 4496	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	107
PID 4820 wrote to memory of 1888	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	108
PID 4820 wrote to memory of 4856	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	109
PID 4820 wrote to memory of 5964	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	110
PID 4820 wrote to memory of 5588	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	111
PID 4820 wrote to memory of 2584	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	112
PID 4820 wrote to memory of 1408	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	113
PID 4820 wrote to memory of 2360	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	114
PID 4820 wrote to memory of 5076	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	115
PID 4820 wrote to memory of 3644	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	116
PID 4820 wrote to memory of 2492	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	117
PID 4820 wrote to memory of 3120	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	118
PID 4820 wrote to memory of 2336	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	119
PID 4820 wrote to memory of 1472	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	120
PID 4820 wrote to memory of 4792	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	121
PID 4820 wrote to memory of 2864	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	122
PID 4820 wrote to memory of 2308	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	123
PID 4820 wrote to memory of 1668	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	124
PID 4820 wrote to memory of 4436	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	125
PID 4820 wrote to memory of 3388	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	126
PID 4820 wrote to memory of 1576	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	127
PID 4820 wrote to memory of 1136	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	128
PID 4820 wrote to memory of 1572	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	129
PID 4820 wrote to memory of 3016	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	130
PID 4820 wrote to memory of 4244	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	131
PID 4820 wrote to memory of 356	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	132
PID 4820 wrote to memory of 264	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	133
PID 4820 wrote to memory of 240	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	134
PID 4820 wrote to memory of 1072	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	135
PID 4820 wrote to memory of 2688	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	136
PID 4820 wrote to memory of 5888	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	137
PID 4820 wrote to memory of 5740	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	138
PID 4820 wrote to memory of 1492	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	139
PID 4820 wrote to memory of 6140	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	140
PID 4820 wrote to memory of 2704	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	141
PID 4820 wrote to memory of 6132	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	142
PID 4820 wrote to memory of 5280	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	143
PID 4820 wrote to memory of 5636	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	144
PID 4820 wrote to memory of 4424	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	145
PID 4820 wrote to memory of 5704	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	146
PID 4820 wrote to memory of 2416	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	147
PID 4820 wrote to memory of 1540	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	148
PID 4820 wrote to memory of 2936	4820	2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe	149
PID 5684 wrote to memory of 5148	5684	USBMonitorSrv.exe	151
PID 5148 wrote to memory of 2064	5148	yyzUSB.exe	152
PID 5148 wrote to memory of 5756	5148	yyzUSB.exe	153
PID 5148 wrote to memory of 5400	5148	yyzUSB.exe	154

C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820
- C:\USBMonitorSrv.exe
  /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5020
- C:\Users\Admin\AppData\Local\Temp\host.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:6012
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1420
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3348
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5964
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5740
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:6140
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:6132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5280
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5636
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-04_e6311417ca75f111456ed813a9a769b8_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2936

C:\USBMonitorSrv.exe
C:\USBMonitorSrv.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5684
- C:\yyzUSB.exe
  "C:\yyzUSB.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5148
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    - Executes dropped EXE
    PID:2064
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    - Executes dropped EXE
    PID:5756
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5400
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5980
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1680
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2476
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3884
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5104
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3416
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2256
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4844
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1268
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6080
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2908
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2876
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6016
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:432
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5316
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5616
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5620
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5332
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5976
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1988
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5712
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4124
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4344
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4568
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3084
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5768
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3004
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1928
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4648
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1676
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3420
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4324
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3236
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4316
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:248
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3180
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:912
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3312
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1776
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1620
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2424
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5708
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2772
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3140
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3556
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3328
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4848
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4216
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3436
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5472
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4408
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1672
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1964
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1856
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4072
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5044
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3760
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5576
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4300
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:852
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3876
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5124
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2844
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1688
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:812
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2860
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3708
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2604
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2684
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5792
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1636
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2024
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2536
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1032
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4136
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4764
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5564
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:52
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:108
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4608
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3712
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4540
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:904
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5880
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4148
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1172
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1096
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4544
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2528
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4864
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5420
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1544
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6096
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3452
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2116
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1320
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4592
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2376
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3732
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4900
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2792
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1884
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4776
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4112
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3396
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5856
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1244
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4936
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3000
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4696
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1760
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5508
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5416
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4580
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5240
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4368
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1876
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5140
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4932
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5896
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4336
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2052
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3864
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2980
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2316
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2768
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1148
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3892
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6152
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6168
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6176
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6184
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6192
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6200
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6208
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6216
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6224
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6232
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6240
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6248
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6256
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6264
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6272
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6280
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6288
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6296
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6304
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6312
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6320
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6328
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6336
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6344
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6352
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6360
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6368
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6376
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6384
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6392
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6400
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6408
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6416
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6424
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6432
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6440
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6448
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6456
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6464
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6472
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6480
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6488
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6496
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6504
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6512
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6520
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6528
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6536
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6544
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6552
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6560
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6568
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6576
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6584
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6592
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6600
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6608
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6616
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6624
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6632
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6640
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6648
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6656
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6664
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6672
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6680
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6688
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6696
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6704
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6712
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6720
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6728
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6736
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6744
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6752
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6760
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6768
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6776
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6784
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6792
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6800
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6808
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6816
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6824
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6832
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6840
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6848
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6856
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6864
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6872
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6880
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6888
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6896
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6904
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6912
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6920
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6928
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6936
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6944
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6952
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6960
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6968
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6976
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6984
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6992
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7000
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7008
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7016
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7024
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7032
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7040
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7048
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7056
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7064
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7072
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7080
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7088
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7096
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7104
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7112
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7120
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7128
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7136
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7144
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7152
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4716
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7172
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7180
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7188
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7196
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7204
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7212
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7220
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7228
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7236
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7244
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7252
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7260
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7268
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7276
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7284
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7292
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7300
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7308
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7316
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7324
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7332
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7340
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7348
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7356
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7364
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7372
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7380
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7388
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7396
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7404
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7412
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7420
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7428
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7436
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7444
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7452
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7460
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7468
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7476
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7484
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7492
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7500
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7508
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7516
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7524
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7532
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7540
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7548
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7556
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7564
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7572
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7580
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7588
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7596
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7604
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7612
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7620
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7628
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7636
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7648
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7656
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7664
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7676
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7684
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7692
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7700
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7708
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7716
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7724
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7732
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7740
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7748
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7756
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7764
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7772
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7780
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7788
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7796
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7804
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7812
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7820
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7828
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7836
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7844
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7852
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7860
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7868
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7876
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7884
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7892
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7900
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7908
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7916
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7924
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7932
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7940
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7948
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7956
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7964
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7972
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7980
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7988
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7996
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8004
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8012
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8020
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8028
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8036
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8044
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8052
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8060
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8068
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8076
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8084
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8092
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8100
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8108
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8116
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8124
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8132
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8140
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8148
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8156
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8164
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8172
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8180
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8188
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2632
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8200
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8208
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8216
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8224
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8232
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8240
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8248
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8256
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8264
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8272
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8280
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8288
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8296
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8304
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8312
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8320
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8328
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8336
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8344
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8352
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8360
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8368
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8376
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8384
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8392
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8400
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8408
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8416
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8424
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8432
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8440
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8448
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8456
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8464
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8472
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8480
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8488
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8496
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8504
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8512
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8524
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8820
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8828
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8836
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8844
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8852
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8860
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8868
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8876
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8884
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8892
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8900
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8908
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8916
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8924
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8932
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8960
- - C:\Windows\SysWOW64\host.exe
    "C:\yyzUSB.exe"
    3⤵
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    PID:10212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Daemon.exe

Path C:\Daemon.exe
Size 454KB
SHA256 1d4a9e19b470570cf52676d3cad4dfb8880e7fba83df9a034792677c2f4c8e32
MD5 6175b5dc639ebb11fc708a67b4e7a3e3
SHA1 d8f5a80e548ec700cfa0b85293ea15e8b4141e8c
SHA512 8653c2fd4107cf636fca88446ce6bdc3262ad61376eb464096e2d1bf48d2b807c4e09c98fcd5a070f296d0e1314f8d8b3e439ec70697d3198a5f962e750b4007
SSDEEP 6144:G7JJY5Hebd8Rr6FoYpD6Ws0la8CFt4X8/nClI1wyhmz1q:WJY5HmqRr6FoYpDan8q+86lIyI
TLSH
T1D2A438016A60C029F3B673F46A6EE168945D7DB04768A4CFE1E57AF986301F26C3325F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

USBMonitorSrv.exe

Path C:\USBMonitorSrv.exe
Size 694KB
SHA256 f92c2d3b3f1df60b6401f697a05bd3e200a824a9aa2cc84a021963c911987c20
MD5 9ac3dc0ce15644d39b039527d942685c
SHA1 a08e14954fd47f58eeec36e9942a12557066c7d1
SHA512 360d31a9e66802a18610c8688be17c3bbf762db62c0f36a1b20477d42648bacbd8a0d50a54d05f1745fbb576c87878716242bdc2e7b81dff276e592d37182522
SSDEEP 12288:GHtTeTvIchy4LoLtlG8ZtwJ0ofJ2/5v7nL9Hwn6Lz:gCvz44sLy0aZJQ5Te6L
TLSH
T10FE45A10BB518429FDF751F54AFEA17C952C79B0DB9C20CB60C953EA463A6F02E36287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host.exe

Path C:\Users\Admin\AppData\Local\Temp\host.exe
Size 847KB
SHA256 e81b44ee7381ae3b630488b6fb7e3d9ffbdd9ac3032181d4ccaaff3409b57316
MD5 c8f40f25f783a52262bdaedeb5555427
SHA1 e45e198607c8d7398745baa71780e3e7a2f6deca
SHA512 f5944743f54028eb1dd0f2d68468726b177d33185324da0da96cdd20768bab4ca2e507ae9157b2733fd6240c920b7e15a5f5b9f284ee09d0fd385fc895b97191
SSDEEP 12288:9pnF6Ee+Rp4tqkWjQ+iOklku0/04gNphgBBO75nONT3vx2zVP:nZe0p4Ek4niOkl/A04szE87JKTvm
TLSH
T1CE05B759F5788323D0B3D0BAC5D7BA99FD3230455B308ACB024AD76C2E276D68636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.log

Path C:\service.log
Size 431B
SHA256 3157b5e5a773c925aa26c9c281155d7d87bd9843bbfcdf87c1a738d7a11ecfa3
MD5 ce682a1796f05eba49f093a3c720e6f3
SHA1 74cf93d9d4b5048561c36c2c45c34017bb1d7683
SHA512 b539ede4d89f061e80c213b6b75920972c15b6edf1fe61b59cd2ff66273589c5fee6e352c5e3d6f3718095bcc56c68bb6f0b3da936c1909add3a096fce69b25c
TLSH
T128E0ED4110C812FBCAC72429AE932389DF5B32281C3CF0A543FA3D1930DBD0D60AC28A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/240-206-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/248-271-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/264-205-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/356-227-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/432-261-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/912-276-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/1072-201-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/1136-194-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/1268-272-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/1408-180-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/1420-132-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/1472-191-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/1492-209-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/1540-213-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/1572-226-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/1576-193-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/1620-279-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/1668-229-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/1676-266-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/1776-278-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/1888-203-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/1928-264-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/1952-197-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/1992-198-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/2308-228-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/2336-190-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/2360-181-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/2416-212-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/2424-280-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/2476-288-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/2492-182-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/2584-179-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/2688-207-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/2704-210-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/2772-282-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/2864-192-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/2876-260-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/2936-214-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/3004-263-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/3016-195-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/3036-175-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/3120-235-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/3140-283-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/3180-275-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/3236-269-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/3312-277-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/3328-285-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/3344-138-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/3348-136-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/3388-225-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/3416-286-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/3420-267-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/3436-291-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/3556-284-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/3644-233-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/3664-196-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/3876-273-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/4132-139-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/4216-290-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/4244-224-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/4316-270-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/4324-268-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/4424-220-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/4436-230-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/4496-199-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/4584-176-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/4648-265-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/4676-178-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/4680-137-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/4692-177-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/4792-231-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/4804-145-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/4820-2-0x0000000000120000-0x000000000043C000-memory.dmp

Download

memory/4820-3-0x0000000000232000-0x0000000000233000-memory.dmp

Download

memory/4844-287-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/4848-289-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/4856-204-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/4880-134-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/5020-259-0x0000000000D60000-0x0000000000E56000-memory.dmp

Download

memory/5020-10-0x0000000000D60000-0x0000000000E56000-memory.dmp

Download

memory/5076-217-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/5080-232-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/5080-146-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/5148-256-0x00000000002C0000-0x00000000005DC000-memory.dmp

Download

memory/5280-215-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/5472-292-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/5588-223-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/5636-219-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/5704-211-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/5708-281-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/5740-218-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/5768-262-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/5888-208-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/5964-202-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/6132-216-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

memory/6140-200-0x00000000007B0000-0x000000000084C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads