6ae6890648afb098da6b348528d47e205d2b47a16523b1609431b6ddc83f471b

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe
Size 2.2MB
Sample261024-dmr8eaeb42
SHA256 6ae6890648afb098da6b348528d47e205d2b47a16523b1609431b6ddc83f471b
MD5 9c7fe53be388a5278e047d8ee5d615b0
SHA1 eb9bdcea0bc075e635f4eeb4368f68c7f02ca16c
SHA512 8ce7ae2098294df8c38227f2e070321c9086aa3e211eadc438e956ccfd4c74a2e5a1b2bb6a643ecde3ee5fe0f62e001d34ff4f888d7c3492722fa95b425a920e
SSDEEP 24576:VENJKEt6dq8hXj8R2vxW870KH/e5GqR6FokG81Cvz44sLy0aZJQ5Te6LhJIU3:VENwzIR257BWIqR6FoRvku04YLhJIU
TLSH
T15BB56C11BB108065FAF752F55AADE168961D7CB08B9860CBB1D573FE8A362F02D33247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4176	USBMonitorSrv.exe
5252	host.exe
2756	Daemon.exe
5472	Daemon.exe
4308	Daemon.exe
2032	Daemon.exe
2264	Daemon.exe
4884	Daemon.exe
4516	Daemon.exe
3824	Daemon.exe
1460	Daemon.exe
3480	Daemon.exe
3164	Daemon.exe
5724	Daemon.exe
3392	Daemon.exe
3260	Daemon.exe
5844	Daemon.exe
5268	Daemon.exe
3272	Daemon.exe
5048	Daemon.exe
2596	Daemon.exe
6124	Daemon.exe
376	Daemon.exe
424	Daemon.exe
264	Daemon.exe
248	Daemon.exe
912	Daemon.exe
4432	Daemon.exe
5824	Daemon.exe
1600	Daemon.exe
2196	Daemon.exe
3908	Daemon.exe
3476	Daemon.exe
3940	Daemon.exe
5076	Daemon.exe
5708	Daemon.exe
3584	Daemon.exe
5812	Daemon.exe
5896	Daemon.exe
2436	Daemon.exe
4512	Daemon.exe
5324	Daemon.exe
4752	Daemon.exe
5184	Daemon.exe
2976	Daemon.exe
5672	Daemon.exe
1384	Daemon.exe
3228	Daemon.exe
2988	Daemon.exe
1412	Daemon.exe
1892	Daemon.exe
1124	Daemon.exe
4784	Daemon.exe
3836	Daemon.exe
4440	Daemon.exe
2172	Daemon.exe
1248	Daemon.exe
3520	Daemon.exe
2584	Daemon.exe
3028	Daemon.exe
1912	Daemon.exe
4628	Daemon.exe
4852	Daemon.exe
1332	Daemon.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\copied.exe	yyzUSB.exe
File created	C:\Windows\SysWOW64\host.exe	yyzUSB.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBMonitorSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBMonitorSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yyzUSB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 4176	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	89
PID 1568 wrote to memory of 5252	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	90
PID 1568 wrote to memory of 2756	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	92
PID 1568 wrote to memory of 5472	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	93
PID 1568 wrote to memory of 4308	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	94
PID 1568 wrote to memory of 2032	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	95
PID 1568 wrote to memory of 2264	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	96
PID 1568 wrote to memory of 4884	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	97
PID 1568 wrote to memory of 4516	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	98
PID 1568 wrote to memory of 3824	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	99
PID 1568 wrote to memory of 1460	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	100
PID 1568 wrote to memory of 3480	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	101
PID 1568 wrote to memory of 3164	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	102
PID 1568 wrote to memory of 5724	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	103
PID 1568 wrote to memory of 3392	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	104
PID 1568 wrote to memory of 3260	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	105
PID 1568 wrote to memory of 5844	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	106
PID 1568 wrote to memory of 5268	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	107
PID 1568 wrote to memory of 3272	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	108
PID 1568 wrote to memory of 5048	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	109
PID 1568 wrote to memory of 2596	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	110
PID 1568 wrote to memory of 6124	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	111
PID 1568 wrote to memory of 376	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	112
PID 1568 wrote to memory of 424	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	113
PID 1568 wrote to memory of 264	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	114
PID 1568 wrote to memory of 248	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	115
PID 1568 wrote to memory of 912	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	116
PID 1568 wrote to memory of 4432	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	117
PID 1568 wrote to memory of 5824	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	118
PID 1568 wrote to memory of 1600	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	119
PID 1568 wrote to memory of 2196	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	120
PID 1568 wrote to memory of 3908	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	121
PID 1568 wrote to memory of 3476	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	122
PID 1568 wrote to memory of 3940	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	123
PID 1568 wrote to memory of 5076	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	124
PID 1568 wrote to memory of 5708	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	125
PID 1568 wrote to memory of 3584	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	126
PID 1568 wrote to memory of 5812	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	127
PID 1568 wrote to memory of 5896	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	128
PID 1568 wrote to memory of 2436	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	129
PID 1568 wrote to memory of 4512	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	130
PID 1568 wrote to memory of 5324	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	131
PID 1568 wrote to memory of 4752	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	132
PID 1568 wrote to memory of 5184	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	133
PID 1568 wrote to memory of 2976	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	134
PID 1568 wrote to memory of 5672	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	135
PID 1568 wrote to memory of 1384	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	136
PID 1568 wrote to memory of 3228	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	137
PID 1568 wrote to memory of 2988	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	138
PID 1568 wrote to memory of 1892	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	139
PID 1568 wrote to memory of 1412	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	140
PID 1568 wrote to memory of 1124	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	141
PID 1568 wrote to memory of 4784	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	142
PID 1568 wrote to memory of 3836	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	143
PID 1568 wrote to memory of 4440	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	144
PID 1568 wrote to memory of 2172	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	145
PID 1568 wrote to memory of 1248	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	146
PID 1568 wrote to memory of 3520	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	147
PID 1568 wrote to memory of 2584	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	148
PID 1568 wrote to memory of 3028	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	149
PID 1568 wrote to memory of 1912	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	150
PID 1568 wrote to memory of 4628	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	151
PID 1568 wrote to memory of 4852	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	152
PID 1568 wrote to memory of 1332	1568	2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe	153

C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1568
- C:\USBMonitorSrv.exe
  /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4176
- C:\Users\Admin\AppData\Local\Temp\host.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5252
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2756
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5472
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5724
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5268
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:6124
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:424
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:248
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5812
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5324
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5184
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2104
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5604
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1184
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5904
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5696
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5080
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5612
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:840
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1476
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4144
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3024
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1320
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2392
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4560
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1964
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4072
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1420
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5796
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3776
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2812
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3772
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3016
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3252
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1224
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1308
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1240
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1820
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4960
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2300
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5792
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c7fe53be388a5278e047d8ee5d615b0_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5676

C:\USBMonitorSrv.exe
C:\USBMonitorSrv.exe
1⤵
- System Location Discovery: System Language Discovery
PID:5396
- C:\yyzUSB.exe
  "C:\yyzUSB.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2268
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5652
- - C:\Windows\SysWOW64\host.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1736
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5892
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3348
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4608
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3156
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1544
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2592
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5544
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4868
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:736
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4892
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2424
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3960
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3304
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3964
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:244
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6080
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2516
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4484
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:236
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4080
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2600
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4192
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3368
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4468
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4272
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2024
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4376
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5560
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4092
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4520
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4416
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3712
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1668
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4716
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1784
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4596
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3540
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:308
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5220
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5476
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:620
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2844
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1260
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3296
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4992
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4956
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3336
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6152
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6168
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6176
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6184
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6192
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6200
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6208
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6216
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6224
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6232
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6240
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6248
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6256
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6264
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6272
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6280
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6288
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6296
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6304
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6312
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6320
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6328
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6336
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6344
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6352
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6360
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6368
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6376
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6384
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6392
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6400
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6408
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6416
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6424
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6432
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6440
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6448
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6456
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6464
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6472
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6480
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6488
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6496
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6504
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6512
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6520
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6528
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6536
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6544
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6552
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6560
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6568
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6576
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6584
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6592
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6600
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6608
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6616
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6624
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6632
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6640
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6648
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6656
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6664
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6672
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6680
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6688
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6696
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6704
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6712
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6720
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6728
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6736
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6744
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6752
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6760
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6768
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6776
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6784
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6792
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6800
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6808
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6816
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6824
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6832
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6840
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6848
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6856
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6864
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6872
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6880
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6888
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6896
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6904
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6912
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6920
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6928
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6936
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6944
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6952
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6960
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6968
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6976
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6984
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6992
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7000
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7008
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7016
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7024
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7032
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7040
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7048
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7056
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7064
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7072
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7080
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7088
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7096
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7104
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7112
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7120
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7128
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7136
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7144
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7152
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7172
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7180
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7188
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7196
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7204
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7212
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7220
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7228
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7236
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7244
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7252
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7260
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7268
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7276
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7284
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7292
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7300
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7308
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7316
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7324
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7332
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7340
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7348
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7356
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7364
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7372
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7380
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7388
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7396
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7404
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7412
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7420
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7428
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7436
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7444
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7452
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7460
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7468
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7476
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7484
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7492
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7500
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7508
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7516
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7524
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7532
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7540
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7548
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7556
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7564
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7572
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7580
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7588
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7596
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7604
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7612
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7620
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7628
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7636
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7644
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7652
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7660
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7668
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7676
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7684
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7692
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7700
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7708
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7716
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7724
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7732
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7740
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7748
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7756
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7764
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7772
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7780
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7788
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7796
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7804
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7812
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7820
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7828
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7836
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7844
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7852
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7860
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7868
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7876
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7884
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7892
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7900
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7908
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7916
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7924
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7932
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7940
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7948
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7968
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7976
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7984
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7992
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8000
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8008
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8016
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8024
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8032
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8040
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8048
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8056
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8064
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8072
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8080
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8088
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8096
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8104
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8112
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8120
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8128
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8136
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8144
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8152
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8168
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8176
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8184
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5024
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:640
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8200
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8208
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8216
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8228
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8236
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8244
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8256
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8264
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8272
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8280
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8288
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8296
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8304
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8312
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8320
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8328
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8336
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8344
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8352
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8360
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8368
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8376
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8384
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8392
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8400
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8408
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8416
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8424
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8432
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8440
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8448
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8456
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8464
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8472
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8480
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8488
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8496
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8504
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8512
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8520
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8528
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8536
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8544
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8552
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8560
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8568
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8576
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8584
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8592
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8600
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8608
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8616
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8624
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8632
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8640
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8648
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8656
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8664
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8672
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8680
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8688
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8696
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8704
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8712
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8720
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8728
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8736
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8744
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8752
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8760
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8768
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8776
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8784
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8792
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8800
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8808
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8816
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8824
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8832
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8840
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8848
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8856
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8864
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8876
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8884
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8896
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8904
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8912
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8920
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8928
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8936
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8944
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8952
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8960
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8968
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8976
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8984
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8992
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9000
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9008
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9016
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9024
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9032
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9040
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9048
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9056
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9064
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9072
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9080
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9088
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9096
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9104
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9112
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9120
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9128
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9136
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9144
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9152
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9168
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Daemon.exe

Path C:\Daemon.exe
Size 454KB
SHA256 1d4a9e19b470570cf52676d3cad4dfb8880e7fba83df9a034792677c2f4c8e32
MD5 6175b5dc639ebb11fc708a67b4e7a3e3
SHA1 d8f5a80e548ec700cfa0b85293ea15e8b4141e8c
SHA512 8653c2fd4107cf636fca88446ce6bdc3262ad61376eb464096e2d1bf48d2b807c4e09c98fcd5a070f296d0e1314f8d8b3e439ec70697d3198a5f962e750b4007
SSDEEP 6144:G7JJY5Hebd8Rr6FoYpD6Ws0la8CFt4X8/nClI1wyhmz1q:WJY5HmqRr6FoYpDan8q+86lIyI
TLSH
T1D2A438016A60C029F3B673F46A6EE168945D7DB04768A4CFE1E57AF986301F26C3325F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

USBMonitorSrv.exe

Path C:\USBMonitorSrv.exe
Size 694KB
SHA256 f92c2d3b3f1df60b6401f697a05bd3e200a824a9aa2cc84a021963c911987c20
MD5 9ac3dc0ce15644d39b039527d942685c
SHA1 a08e14954fd47f58eeec36e9942a12557066c7d1
SHA512 360d31a9e66802a18610c8688be17c3bbf762db62c0f36a1b20477d42648bacbd8a0d50a54d05f1745fbb576c87878716242bdc2e7b81dff276e592d37182522
SSDEEP 12288:GHtTeTvIchy4LoLtlG8ZtwJ0ofJ2/5v7nL9Hwn6Lz:gCvz44sLy0aZJQ5Te6L
TLSH
T10FE45A10BB518429FDF751F54AFEA17C952C79B0DB9C20CB60C953EA463A6F02E36287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host.exe

Path C:\Users\Admin\AppData\Local\Temp\host.exe
Size 281KB
SHA256 6d54694077faf07473196da7b7f1c6981c8ad6a462fcea4777a80cfc6bc5769e
MD5 3dc3594fb3b25c55081fe4b3226abbc2
SHA1 7eaddfd597fc76244f71f98877f7149c9e85dc9e
SHA512 8f268673c86e2c38d1713696ed25b75a565d8beb5b05ea755c9cbb12f625b8d4abfc1bb3f9f54c297ba4bd7dd9e465737c30f492aaef0034b0e1568ce13d2445
SSDEEP 6144:zOOr/BJ/GKWWBNU6ITLBi0qttclOKgU91Bg:meBNUbTVO86Uq
TLSH
T11254E73BEE28FCD2C27A8DB85A918640E77274704B61A3CBD175830EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.log

Path C:\service.log
Size 429B
SHA256 d51d8c202622a0d7d0b59e5743fd9d80ef02283970bc82d333f8971c10239e7f
MD5 4ac622c2cc98488f5618001ef6324f0d
SHA1 9cdf492c3c5c3d4a85296cbfd8109862d70e4cf3
SHA512 32f796eff2fd1e55d609ab2f5dfffa850f97027f99bf04dc1b803ee4ea53fe09182e615968088faa7bf9ffba20948589d44462e0bc649048659c68e8a5cfd825
TLSH
T13EE0ED4210C812F3C6C22429AEA32388DF5B32691C3CB09143FA3D2920DBD0D6068286
MD5 SHA1 SHA512 TLSH

Submit Download

memory/248-228-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/264-204-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/376-202-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/424-203-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/840-247-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/912-215-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/968-232-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/1124-233-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/1132-288-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/1184-277-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/1224-267-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/1240-270-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/1248-272-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/1308-257-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/1332-273-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/1384-224-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/1408-251-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/1412-236-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/1420-243-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/1460-212-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/1568-0-0x00000000007D0000-0x0000000000A5E000-memory.dmp

Download

memory/1568-3-0x00000000008E2000-0x00000000008E3000-memory.dmp

Download

memory/1600-208-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/1820-268-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/1892-275-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/1912-234-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/2032-193-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/2180-266-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/2196-206-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/2264-191-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/2300-254-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/2392-244-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/2436-218-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/2452-256-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/2596-246-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/2756-185-0x0000000000B18000-0x0000000000B19000-memory.dmp

Download

memory/2756-92-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/2812-263-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/2988-225-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3016-252-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3024-241-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3028-274-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3132-262-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3164-230-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3228-280-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3252-258-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3260-197-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3272-200-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3392-227-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3476-213-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3480-226-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3520-245-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3584-207-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3772-248-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3776-265-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3824-231-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3872-259-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3908-216-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/3940-235-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/4176-12-0x0000000000020000-0x0000000000116000-memory.dmp

Download

memory/4308-195-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/4432-205-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/4440-279-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/4512-219-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/4516-192-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/4628-249-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/4664-260-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/4712-261-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/4752-221-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/4784-276-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/4884-194-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/4948-240-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5048-201-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5076-210-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5080-239-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5092-271-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5184-222-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5268-199-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5324-220-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5472-209-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5604-211-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5612-269-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5672-223-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5692-264-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5696-250-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5708-238-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5724-196-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5792-253-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5812-237-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5824-214-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5844-198-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5880-255-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5896-217-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5904-278-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/5916-242-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

memory/6124-229-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads