d72e59ec5bfb3555a43ecd6c88350611ad478bb04500bea49c26c1e739bf5864

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe
Size 2.1MB
Sample261023-ntssmacg37
SHA256 d72e59ec5bfb3555a43ecd6c88350611ad478bb04500bea49c26c1e739bf5864
MD5 5ec815767e1844537befedacd7c04fc4
SHA1 e7d9c8a62a90484db0e9abf0330ea7ba36262efd
SHA512 fbb4a8f72a285dacaafd00092701fd836dfba44b637bbea7e42249fa482853bd5698d7159a578246bc90959d7f21efaf2d0b73456abc31d417959a19ef86bad8
SSDEEP 24576:qENJKEt6dq8hXj8R2vxW870KHAe5GqR6FokG81Cvz44sLy0aZJQ5Te6LIoOQhA:qENwzIR257BDIqR6FoRvku04YLz
TLSH
T174A54A10AB508028FAF752F55AADE1AC952C7DF0879860CBB1D576FA46366F02D33387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2720	USBMonitorSrv.exe
2656	host.exe
3880	Daemon.exe
2716	Daemon.exe
1780	Daemon.exe
2808	Daemon.exe
5440	Daemon.exe
3752	Daemon.exe
4588	Daemon.exe
5236	Daemon.exe
5860	Daemon.exe
4960	Daemon.exe
2448	Daemon.exe
1544	Daemon.exe
3456	Daemon.exe
5100	Daemon.exe
4932	Daemon.exe
4868	Daemon.exe
1320	Daemon.exe
2128	Daemon.exe
4676	Daemon.exe
5992	Daemon.exe
2788	Daemon.exe
5972	Daemon.exe
3084	Daemon.exe
4140	Daemon.exe
704	Daemon.exe
800	Daemon.exe
6024	Daemon.exe
2044	Daemon.exe
1116	Daemon.exe
5956	Daemon.exe
3256	Daemon.exe
3508	Daemon.exe
4956	Daemon.exe
3920	Daemon.exe
5664	Daemon.exe
1208	Daemon.exe
1356	Daemon.exe
2168	Daemon.exe
3884	Daemon.exe
404	Daemon.exe
264	Daemon.exe
620	Daemon.exe
5528	Daemon.exe
5988	Daemon.exe
2196	Daemon.exe
3128	Daemon.exe
4440	Daemon.exe
1688	Daemon.exe
4320	Daemon.exe
4232	Daemon.exe
5676	Daemon.exe
5468	Daemon.exe
4548	Daemon.exe
3568	Daemon.exe
3284	Daemon.exe
4776	Daemon.exe
4160	Daemon.exe
4784	Daemon.exe
1136	Daemon.exe
2284	Daemon.exe
4656	Daemon.exe
4468	Daemon.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\copied.exe	yyzUSB.exe
File created	C:\Windows\SysWOW64\host.exe	yyzUSB.exe
File created	C:\Windows\System32\jaccessinspector.log	host.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBMonitorSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yyzUSB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBMonitorSrv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 2720	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	89
PID 4936 wrote to memory of 2656	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	90
PID 4936 wrote to memory of 3880	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	92
PID 4936 wrote to memory of 2716	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	93
PID 4936 wrote to memory of 1780	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	94
PID 4936 wrote to memory of 2808	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	95
PID 4936 wrote to memory of 5440	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	96
PID 4936 wrote to memory of 3752	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	97
PID 4936 wrote to memory of 4588	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	98
PID 4936 wrote to memory of 5236	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	99
PID 4936 wrote to memory of 5860	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	100
PID 4936 wrote to memory of 4960	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	101
PID 4936 wrote to memory of 2448	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	102
PID 4936 wrote to memory of 1544	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	103
PID 4936 wrote to memory of 3456	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	104
PID 4936 wrote to memory of 5100	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	105
PID 4936 wrote to memory of 4932	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	106
PID 4936 wrote to memory of 4868	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	107
PID 4936 wrote to memory of 1320	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	108
PID 4936 wrote to memory of 2128	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	109
PID 4936 wrote to memory of 4676	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	110
PID 4936 wrote to memory of 5992	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	111
PID 4936 wrote to memory of 2788	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	112
PID 4936 wrote to memory of 5972	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	113
PID 4936 wrote to memory of 3084	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	114
PID 4936 wrote to memory of 4140	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	115
PID 4936 wrote to memory of 704	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	116
PID 4936 wrote to memory of 800	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	117
PID 4936 wrote to memory of 6024	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	118
PID 4936 wrote to memory of 2044	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	119
PID 4936 wrote to memory of 1116	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	120
PID 4936 wrote to memory of 5956	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	121
PID 4936 wrote to memory of 3256	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	122
PID 4936 wrote to memory of 3508	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	123
PID 4936 wrote to memory of 4956	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	124
PID 4936 wrote to memory of 3920	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	125
PID 4936 wrote to memory of 5664	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	126
PID 4936 wrote to memory of 1208	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	127
PID 4936 wrote to memory of 1356	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	128
PID 4936 wrote to memory of 2168	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	129
PID 4936 wrote to memory of 3884	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	130
PID 4936 wrote to memory of 404	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	131
PID 4936 wrote to memory of 264	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	132
PID 4936 wrote to memory of 620	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	133
PID 4936 wrote to memory of 5528	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	134
PID 4936 wrote to memory of 5988	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	135
PID 4936 wrote to memory of 2196	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	136
PID 4936 wrote to memory of 3128	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	137
PID 4936 wrote to memory of 4440	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	138
PID 4936 wrote to memory of 1688	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	139
PID 4936 wrote to memory of 4320	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	140
PID 4936 wrote to memory of 4232	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	141
PID 4936 wrote to memory of 5676	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	142
PID 4936 wrote to memory of 5468	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	143
PID 4936 wrote to memory of 4548	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	144
PID 4936 wrote to memory of 3568	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	145
PID 4936 wrote to memory of 3284	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	146
PID 4936 wrote to memory of 4776	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	147
PID 4936 wrote to memory of 4160	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	148
PID 4936 wrote to memory of 4784	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	149
PID 4936 wrote to memory of 1136	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	150
PID 4936 wrote to memory of 2284	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	151
PID 4936 wrote to memory of 4656	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	152
PID 4936 wrote to memory of 4468	4936	2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe	153

C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4936
- C:\USBMonitorSrv.exe
  /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2720
- C:\Users\Admin\AppData\Local\Temp\host.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5860
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5992
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:6024
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5528
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5676
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5468
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4520
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1828
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3480
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5500
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:992
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6052
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4448
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6080
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4244
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:860
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5976
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5416
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4436
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4248
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4528
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3784
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4344
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:936
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5332
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5868
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5476
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2532
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4256
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3828
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5616
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5328
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4904
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3312
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:796
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4424
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6152
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6168
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6184
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6200
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6220
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6252
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6268
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6284
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6300
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6316
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6332
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6348
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6380
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6396
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6412
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6428
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6444
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6460
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6476
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6524
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6540
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6556
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6604
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6620
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6636
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6652
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6668
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6684
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6732
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6748
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6768
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6840
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6856
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6904
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6920
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6940
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7004
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7020
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7040
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7056
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7076
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7112
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2608
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7204
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7220
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7244
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7284
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7300
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7316
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7332
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7372
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7380
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7392
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7404
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7412
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7420
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7536
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7548
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7556
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7608
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7620
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-23_5ec815767e1844537befedacd7c04fc4_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7632

C:\USBMonitorSrv.exe
C:\USBMonitorSrv.exe
1⤵
- System Location Discovery: System Language Discovery
PID:3524
- C:\yyzUSB.exe
  "C:\yyzUSB.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:5648
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5896
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1184
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2816
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4600
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2812
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3036
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3368
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4040
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5056
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1400
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7472
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7644
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7740
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3500
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7564
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7388
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2500
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1528
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5508
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7448
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6244
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6312
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6600
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7776
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7784
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7800
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4276
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7984
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8100
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7824
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2700
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6260
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2360
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2560
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5032
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4404
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7660
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7616
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3392
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7764
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7744
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6196
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6344
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7360
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7888
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7724
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6228
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8068
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8060
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2772
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2868
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8088
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7772
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2876
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6452
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7428
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7844
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6660
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7528
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6296
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3152
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7532
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3548
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7640
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:428
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6468
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7452
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6392
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3180
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7568
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7796
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:828
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2088
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7848
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7832
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4780
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7456
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7732
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6692
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4044
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6880
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6896
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1816
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6916
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6936
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6976
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7000
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7016
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7048
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7032
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7084
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7108
- - C:\Windows\SysWOW64\host.exe
    "C:\yyzUSB.exe"
    3⤵
    - Drops file in System32 directory
    PID:6596
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7140
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7156
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7172
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7192
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7212
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7232
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7256
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1524
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7324
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:248
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5540
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2628
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1572
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7672
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:408
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3676
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5756
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2484
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Daemon.exe

Path C:\Daemon.exe
Size 454KB
SHA256 1d4a9e19b470570cf52676d3cad4dfb8880e7fba83df9a034792677c2f4c8e32
MD5 6175b5dc639ebb11fc708a67b4e7a3e3
SHA1 d8f5a80e548ec700cfa0b85293ea15e8b4141e8c
SHA512 8653c2fd4107cf636fca88446ce6bdc3262ad61376eb464096e2d1bf48d2b807c4e09c98fcd5a070f296d0e1314f8d8b3e439ec70697d3198a5f962e750b4007
SSDEEP 6144:G7JJY5Hebd8Rr6FoYpD6Ws0la8CFt4X8/nClI1wyhmz1q:WJY5HmqRr6FoYpDan8q+86lIyI
TLSH
T1D2A438016A60C029F3B673F46A6EE168945D7DB04768A4CFE1E57AF986301F26C3325F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

USBMonitorSrv.exe

Path C:\USBMonitorSrv.exe
Size 694KB
SHA256 f92c2d3b3f1df60b6401f697a05bd3e200a824a9aa2cc84a021963c911987c20
MD5 9ac3dc0ce15644d39b039527d942685c
SHA1 a08e14954fd47f58eeec36e9942a12557066c7d1
SHA512 360d31a9e66802a18610c8688be17c3bbf762db62c0f36a1b20477d42648bacbd8a0d50a54d05f1745fbb576c87878716242bdc2e7b81dff276e592d37182522
SSDEEP 12288:GHtTeTvIchy4LoLtlG8ZtwJ0ofJ2/5v7nL9Hwn6Lz:gCvz44sLy0aZJQ5Te6L
TLSH
T10FE45A10BB518429FDF751F54AFEA17C952C79B0DB9C20CB60C953EA463A6F02E36287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host.exe

Path C:\Windows\SysWOW64\host.exe
Size 103KB
SHA256 792b89cbd462e51406849e6927737f60e5fbd6b2390f7d07237387a9c9c2b510
MD5 5b72c9c60282f6a7b6e5332188943b1f
SHA1 a6004276c40e5d68c5ded16cb9816154be87731a
SHA512 1298978c39a4df42101f62c47b064a37003d72266ce808b3fc7a58c76c3c634e476db744a0c10d5bc382908bf32189440ec0719ca400b5709efbba60d1e79c60
SSDEEP 3072:YvaBU1Lhceff4Sx7nrl/RZZOH7rFxAXX4J1WXoTa00liUNLIcUaZ4aE68Mezni9t:e4U1Lhceff4Sx7nrl/RZZOH7rFxAXX4m
TLSH
T18EA3B34BAB9450D5D8F6C0B894E1A61AEA3131E98330E7DFA794440F4F62BD0BD3DB49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.log

Path C:\service.log
Size 433B
SHA256 13982ede707bb8ccfea5c349b0e8ecfe70083ec1a0e10c322c97a99d89fbc93d
MD5 cd648ed9121fd15a455b741c78bbf5de
SHA1 01720c72aae1ef1fd1fe6bcbbba2b6ea882641ce
SHA512 0d0f570b9696972b6b31198d1d5a256b78b6c659055d44b2a00164e64097c6c26b66f381dde8016a774521c0bd3f1e90b8850abb154089c38f7780f3c07ca017
TLSH
T1B6E0E54110C812F7C6C32425AE932388EF5B32141C3DB8A143FA3D2D20DBD0E6068285
MD5 SHA1 SHA512 TLSH

Submit Download

memory/620-530-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/704-472-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/800-460-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/992-499-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/1116-454-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/1136-481-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/1208-523-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/1356-467-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/1440-514-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/1544-458-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/1780-463-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/1828-494-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/2044-453-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/2128-447-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/2168-466-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/2196-510-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/2284-489-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/2448-468-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/2716-465-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/2720-12-0x00000000004B0000-0x00000000005A6000-memory.dmp

Download

memory/2788-450-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/2808-459-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/3084-452-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/3256-528-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/3284-477-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/3340-502-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/3456-456-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/3480-496-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/3508-457-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/3568-476-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/3752-462-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/3880-278-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/3880-464-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/3884-519-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/3920-455-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/4140-529-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/4160-479-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/4232-512-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/4320-526-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/4448-508-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/4468-491-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/4520-493-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/4548-516-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/4656-490-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/4676-448-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/4776-478-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/4784-480-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/4804-492-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/4868-446-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/4932-445-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/4936-0-0x0000000000C50000-0x0000000000EB2000-memory.dmp

Download

memory/4936-1-0x0000000000D62000-0x0000000000D63000-memory.dmp

Download

memory/4956-522-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/4956-475-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/4988-495-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/5100-444-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/5236-470-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/5332-518-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/5440-469-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/5500-498-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/5860-461-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/5956-474-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/5972-451-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/5980-497-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/5988-534-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/5992-449-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6024-473-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6080-524-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6168-520-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6184-531-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6220-500-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6236-517-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6252-511-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6268-483-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6284-488-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6300-501-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6316-484-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6332-525-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6364-521-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6444-513-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6460-487-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6476-471-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6492-504-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6524-485-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6540-507-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6572-482-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6588-503-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6604-515-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6620-486-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6700-533-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6716-527-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6748-535-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6768-505-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6804-532-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/6824-506-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

memory/7380-509-0x0000000000E10000-0x0000000000EAC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads