d72e59ec5bfb3555a43ecd6c88350611ad478bb04500bea49c26c1e739bf5864

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe
Size 2.1MB
Sample261023-ntssmacg37
SHA256 d72e59ec5bfb3555a43ecd6c88350611ad478bb04500bea49c26c1e739bf5864
MD5 5ec815767e1844537befedacd7c04fc4
SHA1 e7d9c8a62a90484db0e9abf0330ea7ba36262efd
SHA512 fbb4a8f72a285dacaafd00092701fd836dfba44b637bbea7e42249fa482853bd5698d7159a578246bc90959d7f21efaf2d0b73456abc31d417959a19ef86bad8
SSDEEP 24576:qENJKEt6dq8hXj8R2vxW870KHAe5GqR6FokG81Cvz44sLy0aZJQ5Te6LIoOQhA:qENwzIR257BDIqR6FoRvku04YLz
TLSH
T174A54A10AB508028FAF752F55AADE1AC952C7DF0879860CBB1D576FA46366F02D33387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2000	Daemon.exe
3408	USBMonitorSrv.exe
4236	Daemon.exe
508	Daemon.exe
1636	Daemon.exe
1704	Daemon.exe
2492	Daemon.exe
1340	Daemon.exe
372	host.exe
4376	Daemon.exe
740	Daemon.exe
1700	Daemon.exe
4620	Daemon.exe
1112	Daemon.exe
1764	Daemon.exe
5052	Daemon.exe
2196	Daemon.exe
616	Daemon.exe
1896	Daemon.exe
1928	Daemon.exe
4844	Daemon.exe
804	Daemon.exe
4672	Daemon.exe
1888	Daemon.exe
3600	Daemon.exe
4688	Daemon.exe
4488	Daemon.exe
4464	Daemon.exe
3668	Daemon.exe
4652	Daemon.exe
1368	Daemon.exe
4632	Daemon.exe
5072	Daemon.exe
3552	Daemon.exe
4560	Daemon.exe
4372	Daemon.exe
4680	Daemon.exe
4888	Daemon.exe
2136	Daemon.exe
1028	Daemon.exe
1440	Daemon.exe
4152	Daemon.exe
2292	Daemon.exe
2892	Daemon.exe
5032	Daemon.exe
5028	Daemon.exe
3472	Daemon.exe
4428	Daemon.exe
3476	Daemon.exe
1848	Daemon.exe
3824	Daemon.exe
1760	Daemon.exe
4276	Daemon.exe
4136	Daemon.exe
4896	Daemon.exe
5060	Daemon.exe
2376	Daemon.exe
4972	Daemon.exe
1208	Daemon.exe
2100	Daemon.exe
1288	Daemon.exe
60	Daemon.exe
1272	Daemon.exe
1608	Daemon.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\copied.exe	yyzUSB.exe
File opened for modification	C:\Windows\SysWOW64\copied.exe	yyzUSB.exe
File created	C:\Windows\SysWOW64\host.exe	yyzUSB.exe
File created	C:\Windows\System32\jaccessinspector.log	host.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBMonitorSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBMonitorSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yyzUSB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 2000	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	85
PID 860 wrote to memory of 3408	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	86
PID 860 wrote to memory of 4236	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	87
PID 860 wrote to memory of 508	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	88
PID 860 wrote to memory of 1636	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	89
PID 860 wrote to memory of 1704	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	90
PID 860 wrote to memory of 2492	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	91
PID 860 wrote to memory of 1340	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	92
PID 860 wrote to memory of 4376	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	94
PID 860 wrote to memory of 740	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	95
PID 860 wrote to memory of 372	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	93
PID 860 wrote to memory of 1700	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	96
PID 860 wrote to memory of 4620	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	97
PID 860 wrote to memory of 1112	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	98
PID 860 wrote to memory of 1764	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	99
PID 860 wrote to memory of 5052	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	100
PID 860 wrote to memory of 2196	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	101
PID 860 wrote to memory of 616	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	102
PID 860 wrote to memory of 1896	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	103
PID 860 wrote to memory of 1928	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	104
PID 860 wrote to memory of 4844	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	105
PID 860 wrote to memory of 804	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	106
PID 860 wrote to memory of 4672	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	107
PID 860 wrote to memory of 1888	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	108
PID 860 wrote to memory of 3600	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	109
PID 860 wrote to memory of 4688	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	110
PID 860 wrote to memory of 4488	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	111
PID 860 wrote to memory of 4464	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	112
PID 860 wrote to memory of 3668	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	113
PID 860 wrote to memory of 4652	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	114
PID 860 wrote to memory of 1368	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	115
PID 860 wrote to memory of 4632	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	116
PID 860 wrote to memory of 5072	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	117
PID 860 wrote to memory of 3552	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	118
PID 860 wrote to memory of 4560	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	119
PID 860 wrote to memory of 4372	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	120
PID 860 wrote to memory of 4680	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	121
PID 860 wrote to memory of 4888	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	122
PID 860 wrote to memory of 2136	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	123
PID 860 wrote to memory of 1028	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	124
PID 860 wrote to memory of 1440	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	125
PID 860 wrote to memory of 4152	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	126
PID 860 wrote to memory of 2292	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	127
PID 860 wrote to memory of 2892	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	128
PID 860 wrote to memory of 5032	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	129
PID 860 wrote to memory of 5028	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	130
PID 860 wrote to memory of 3472	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	131
PID 860 wrote to memory of 4428	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	132
PID 860 wrote to memory of 3476	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	133
PID 860 wrote to memory of 1848	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	134
PID 860 wrote to memory of 3824	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	135
PID 860 wrote to memory of 1760	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	136
PID 860 wrote to memory of 4276	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	137
PID 860 wrote to memory of 4136	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	138
PID 860 wrote to memory of 4896	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	139
PID 860 wrote to memory of 5060	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	140
PID 860 wrote to memory of 2376	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	141
PID 860 wrote to memory of 4972	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	142
PID 860 wrote to memory of 1208	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	143
PID 860 wrote to memory of 2100	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	144
PID 860 wrote to memory of 1288	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	145
PID 860 wrote to memory of 60	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	146
PID 860 wrote to memory of 1272	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	147
PID 860 wrote to memory of 1608	860	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	148

C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:860
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2000
- C:\USBMonitorSrv.exe
  /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Users\Admin\AppData\Local\Temp\host.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3112
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1604
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3156
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2636
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4832
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3772
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3296
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2952
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2876
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3952
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:208
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:116
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1748
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4504
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4516
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2484
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2480
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3168
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1380
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4436
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4336
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2992
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4840
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4852
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2420
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4032
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:456
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4596
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3556
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2768
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4208
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2528
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3532
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3436
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3784
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2444
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5056
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4296
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2456
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4412
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3792
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1080
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1224
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:984
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4836
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1964
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4900
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1304
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2316
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2516
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3176
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4576
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2284
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4380
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5064
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:884
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4628
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4256
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2536
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2416
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2152
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4936
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3076
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4424
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4196
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1140
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3028
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2448
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4020
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4300
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1528
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2504
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2176
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1556
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1032
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2436
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4176
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5040
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1096
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:412
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2808
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4228
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1448
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1524
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1468
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1936
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2924
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4360
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5144
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5152
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5160
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5168
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5188
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5196
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5204
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5216
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5228
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5244
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5252
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5272
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5280
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5292
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5304
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5312
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5320
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5328
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5348
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5356
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5376
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5388
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5396
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5404
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5412
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5424
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5432
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5460
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5468
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5476
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5484
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5500
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5516
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5524
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5532
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5540
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5548
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5556
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5564
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5580
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5596
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5604
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5612
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5620
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5628
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5636
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5644
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5652
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5660
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5668
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5676
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5684
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5724
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5732
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5740
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5748
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5756
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5764
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5772
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5780

C:\USBMonitorSrv.exe
C:\USBMonitorSrv.exe
1⤵
- System Location Discovery: System Language Discovery
PID:6616
- C:\yyzUSB.exe
  "C:\yyzUSB.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:6760
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6880
- - C:\Windows\SysWOW64\host.exe
    "C:\yyzUSB.exe"
    3⤵
    - Drops file in System32 directory
    PID:6892
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6920
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6936
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6952
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6968
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6984
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7000
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7012
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7032
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7044
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7060
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7076
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7092
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7108
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7124
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7140
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7156
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7176
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7192
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7208
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7220
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7236
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7252
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7268
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7284
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7300
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7316
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7332
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7348
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7364
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7380
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7396
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7412
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7428
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7444
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7460
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7476
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7492
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7508
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7524
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7540
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7556
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7572
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7592
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7604
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7620
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7600
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7640
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7652
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7668
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7684
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7700
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7716
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7732
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7724
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7744
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7764
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7780
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7796
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7812
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7828
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7844
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7860
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7876
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7840
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7896
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7908
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6132
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6108
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6084
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6068
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5372
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7924
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2428
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2652
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5288
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4624
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6064
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6104
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1960
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1256
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5864
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6060
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7984
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6152
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6200
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6228
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6244
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6260
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6276
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6292
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6308
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6324
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6340
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6356
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6384
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6412
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6428
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6440
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6456
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6476
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6496
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6516
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6536
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6568
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6592
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7992
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6652
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6676
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6704
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6724
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6768
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6812
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6844
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6884
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6916
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6948
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6980
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7020
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7052
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7080
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7096
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7112
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7132
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7164
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7200
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7232
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7264
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7292
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7312
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1784
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7344
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7376
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7408
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7440
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7616
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7660
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7680
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7712
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7760
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7804
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7824
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7884
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7904
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7920
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7212
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7180
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7144
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7068
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7028
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3984
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7008
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6976
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6944
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6912
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6876
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6852
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6820
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6792
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6776
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6752
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6708
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6660
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6632
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6604
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6560
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6520
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6396
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6212
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6180
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6168
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6088
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2720
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3528
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3868
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7228
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7488
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7504
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7532
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7548
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7568
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7584
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6612
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7872
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7856
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7820
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7784
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7756
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7708
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7664
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7628
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7596
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7516
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7472
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7452
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7420
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7388
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2836
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7340
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7308
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7260
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7988
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4268
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4264
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4304
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4216
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8200
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8208
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8216
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8224
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8232
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8240
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8248
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8256
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8264
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8272
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8280
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8288
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8296
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8304
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8312
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8320
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8328
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8336
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8344
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8352
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8360
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8368
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8376
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8384
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8392
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8400
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8408
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8416
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8424
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8432
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8440
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8448
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8456
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8464
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8472
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8480
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8488
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8496
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8504
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8512
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8520
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8528
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8536
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8544
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8552
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8560
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8568
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8576
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8584
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8592
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8600
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8608
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8616
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8624
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8632
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8640
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8648
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8656
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8664
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8672
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8680
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8688
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8696
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8704
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8712
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8720
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8728
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8736
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8744
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8752
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8760
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8768
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8776
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8784
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8792
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8800
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8808
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8816
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8824
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8832
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8840
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8848
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8856
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8864
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8872
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8880
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8888
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8896
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8904
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8912
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8920
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8928
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8936
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8944
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8952
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8960
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8968
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8976
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8984
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8992
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9000
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9008
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9016
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9024
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9032
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9040
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9048
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9056
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9064
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9072
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9080
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9088
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9096
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9104
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9112
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9120
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9128
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9136
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9144
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9152
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9168
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9176
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9184
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9192
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9200
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9208
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9220
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9228
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9236
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9244
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9252
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9260
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9268
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9276
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9284
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9292
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9300
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9308
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9316
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9324
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9332
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9340
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9348
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9356
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9364
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9372
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9380
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9388
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9396
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9404
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9412
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9420
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9428
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9436
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9444
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9452
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9460
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9468
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9476
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9484
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9492
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9500
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9508
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9516
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9524
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9532
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9540
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9548
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9556
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9564
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9572
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9580
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9588
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9596
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9604
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9612
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9620
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9628
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9636
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9644
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9652
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9660
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9668
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9676
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9684
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9692
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9700
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9708
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9716
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9724
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9732
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9740
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9748
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9756
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9764
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9772
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9780
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9788
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9796
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9804
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9812
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9820
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9828
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9836
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9844
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9852
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9860
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9868
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9876
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9884
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9892
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9900
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9908
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9916
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9924
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9932
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9940
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9948
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9956
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9964
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9972
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9980
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9988
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9996
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10004
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10012
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10020
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10028
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10036
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10044
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10052
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10060
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10068
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10076
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10084
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10092
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10100
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10108
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10116
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10124
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10132
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10140
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10148
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10156
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10164
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10172
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10180
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10188
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10196
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10204
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10212
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10220
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10228
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10236
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10248
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10256
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10264
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10272
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10280
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10288
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10296
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10304
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10312
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10320
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10328
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10336
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10344
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10352
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10360
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10368
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10376
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10384
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10392
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10400
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10408
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10416
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10424
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10432
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10440
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10448
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10456
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10464
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10472
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10480
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10488
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10496
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10504
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10512
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10520
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10528
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10536
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10544
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10552
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10560
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10568
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10576
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10584
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10592
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10600
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10608
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10616
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10624
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10632
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10640
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10648
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10656
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10664
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10672
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10680
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10688
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10696
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10704
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10712
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10720
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10728
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10736
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10744
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10752
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10760
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10768
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10776
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10784
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10792
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10800
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10808
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10816
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10824
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10832
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10840
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10848
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10856
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10864
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10872
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10880
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10888
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10896
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10904
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10912
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10920
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10928
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10936
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10944
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10952
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10960
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10968
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10976
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10984
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10992
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11000
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11008
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11016
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11024
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11032
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11040
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11048
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11056
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11064
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11072
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11080
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11088
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11096
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11104
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11112
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11120
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11128
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11136
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11144
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11152
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11168
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11176
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11184
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11192
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11200
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11208
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11216
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11224
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11232
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11240
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11248
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11256
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11268
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11276
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11284
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11292
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11300
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11308
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11316
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11324
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11332
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11340
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11348
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11356
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11364
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11372
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11380
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11388
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11396
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11404
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11412
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11420
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11428
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11436
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11444
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11452
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11460
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11468
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11476
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11484
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11492
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11500
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11508
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11516
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11524
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11532
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11540
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11548
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11556
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11564
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11572
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11580
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11588
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11596
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11604
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11612
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11620
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11628
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11636
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11644
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11652
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11660
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11668
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11676
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11684
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11692
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11700
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11708
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11716
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11724
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11732
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11740
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11748
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11756
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11764
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11772
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11780
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11788
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11796
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11804
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11812
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11820
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11828
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11836
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11844
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11852
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11860
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11868
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11876
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11884
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11892
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11900
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11908
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11916
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11924
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11932
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11940
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11948
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11956
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11964
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11972
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11980
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11988
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:11996
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12004
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12012
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12020
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12028
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12036
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12044
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12052
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12060
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12068
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12076
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12084
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12092
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12100
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12108
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12116
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12124
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12132
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12140
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12148
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12156
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12164
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12172
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12180
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12188
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12196
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12204
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12212
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12220
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12228
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12236
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12244
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12252
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12260
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12268
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12276
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12284
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12296
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12304
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12312
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12320
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12328
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12336
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12344
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12352
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12360
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12368
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12376
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12384
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12392
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12400
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12408
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12416
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12424
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12432
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12440
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12448
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12456
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12464
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:12472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Daemon.exe

Path C:\Daemon.exe
Size 454KB
SHA256 1d4a9e19b470570cf52676d3cad4dfb8880e7fba83df9a034792677c2f4c8e32
MD5 6175b5dc639ebb11fc708a67b4e7a3e3
SHA1 d8f5a80e548ec700cfa0b85293ea15e8b4141e8c
SHA512 8653c2fd4107cf636fca88446ce6bdc3262ad61376eb464096e2d1bf48d2b807c4e09c98fcd5a070f296d0e1314f8d8b3e439ec70697d3198a5f962e750b4007
SSDEEP 6144:G7JJY5Hebd8Rr6FoYpD6Ws0la8CFt4X8/nClI1wyhmz1q:WJY5HmqRr6FoYpDan8q+86lIyI
TLSH
T1D2A438016A60C029F3B673F46A6EE168945D7DB04768A4CFE1E57AF986301F26C3325F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

USBMonitorSrv.exe

Path C:\USBMonitorSrv.exe
Size 694KB
SHA256 f92c2d3b3f1df60b6401f697a05bd3e200a824a9aa2cc84a021963c911987c20
MD5 9ac3dc0ce15644d39b039527d942685c
SHA1 a08e14954fd47f58eeec36e9942a12557066c7d1
SHA512 360d31a9e66802a18610c8688be17c3bbf762db62c0f36a1b20477d42648bacbd8a0d50a54d05f1745fbb576c87878716242bdc2e7b81dff276e592d37182522
SSDEEP 12288:GHtTeTvIchy4LoLtlG8ZtwJ0ofJ2/5v7nL9Hwn6Lz:gCvz44sLy0aZJQ5Te6L
TLSH
T10FE45A10BB518429FDF751F54AFEA17C952C79B0DB9C20CB60C953EA463A6F02E36287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

copied.exe

Path C:\Windows\SysWOW64\copied.exe
Size 2.1MB
SHA256 d72e59ec5bfb3555a43ecd6c88350611ad478bb04500bea49c26c1e739bf5864
MD5 5ec815767e1844537befedacd7c04fc4
SHA1 e7d9c8a62a90484db0e9abf0330ea7ba36262efd
SHA512 fbb4a8f72a285dacaafd00092701fd836dfba44b637bbea7e42249fa482853bd5698d7159a578246bc90959d7f21efaf2d0b73456abc31d417959a19ef86bad8
SSDEEP 24576:qENJKEt6dq8hXj8R2vxW870KHAe5GqR6FokG81Cvz44sLy0aZJQ5Te6LIoOQhA:qENwzIR257BDIqR6FoRvku04YLz
TLSH
T174A54A10AB508028FAF752F55AADE1AC952C7DF0879860CBB1D576FA46366F02D33387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host.exe

Path C:\Windows\SysWOW64\host.exe
Size 103KB
SHA256 792b89cbd462e51406849e6927737f60e5fbd6b2390f7d07237387a9c9c2b510
MD5 5b72c9c60282f6a7b6e5332188943b1f
SHA1 a6004276c40e5d68c5ded16cb9816154be87731a
SHA512 1298978c39a4df42101f62c47b064a37003d72266ce808b3fc7a58c76c3c634e476db744a0c10d5bc382908bf32189440ec0719ca400b5709efbba60d1e79c60
SSDEEP 3072:YvaBU1Lhceff4Sx7nrl/RZZOH7rFxAXX4J1WXoTa00liUNLIcUaZ4aE68Mezni9t:e4U1Lhceff4Sx7nrl/RZZOH7rFxAXX4m
TLSH
T18EA3B34BAB9450D5D8F6C0B894E1A61AEA3131E98330E7DFA794440F4F62BD0BD3DB49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.log

Path C:\service.log
Size 433B
SHA256 13982ede707bb8ccfea5c349b0e8ecfe70083ec1a0e10c322c97a99d89fbc93d
MD5 cd648ed9121fd15a455b741c78bbf5de
SHA1 01720c72aae1ef1fd1fe6bcbbba2b6ea882641ce
SHA512 0d0f570b9696972b6b31198d1d5a256b78b6c659055d44b2a00164e64097c6c26b66f381dde8016a774521c0bd3f1e90b8850abb154089c38f7780f3c07ca017
TLSH
T1B6E0E54110C812F7C6C32425AE932388EF5B32141C3DB8A143FA3D2D20DBD0E6068285
MD5 SHA1 SHA512 TLSH

Submit Download

memory/8-145-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/116-173-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/508-50-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/616-109-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/708-139-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/740-103-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/804-111-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/860-19-0x0000000000412000-0x0000000000413000-memory.dmp

Download

memory/860-4-0x0000000000300000-0x0000000000562000-memory.dmp

Download

memory/984-144-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1028-123-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1080-147-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1112-106-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1148-135-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1208-178-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1224-146-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1272-175-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1288-176-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1340-54-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1380-169-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1440-124-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1608-174-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1636-51-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1700-104-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1704-52-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1728-167-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1760-181-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1764-107-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1844-161-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1848-183-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1888-116-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1896-110-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1928-112-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1964-143-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/1972-171-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/2000-47-0x0000000000AB8000-0x0000000000AB9000-memory.dmp

Download

memory/2000-46-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/2100-177-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/2136-122-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/2196-108-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/2292-126-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/2420-162-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/2444-153-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/2480-170-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/2492-53-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/2512-132-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/2516-140-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/2528-155-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/2572-130-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/2752-148-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/2816-157-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/2892-127-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/2992-164-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/3340-133-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/3408-48-0x0000000000150000-0x0000000000246000-memory.dmp

Download

memory/3436-154-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/3492-137-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/3552-185-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/3556-158-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/3600-117-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/3792-149-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/3824-182-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/3980-131-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4032-160-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4152-125-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4236-49-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4296-151-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4372-119-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4376-102-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4380-134-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4412-150-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4428-184-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4440-166-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4504-172-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4508-138-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4512-165-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4560-118-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4572-168-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4576-136-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4596-159-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4620-105-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4652-186-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4672-115-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4680-120-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4700-156-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4720-141-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4840-163-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4844-113-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4888-121-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4896-180-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/4900-142-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/5028-129-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/5032-128-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/5052-114-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/5056-152-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

memory/5060-179-0x0000000000A30000-0x0000000000ACC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads