040f463cecab71a73736f54868f75fb9a6c1663df88fe72c82d9de147e35394b

Analysis

max time kernel
153s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe
Size 2.8MB
Sample261024-fppleafy7w
SHA256 040f463cecab71a73736f54868f75fb9a6c1663df88fe72c82d9de147e35394b
MD5 8ee7ca6bbbe7adcf81459a78400eb9b3
SHA1 210b8256b2d4a5ecb7912a6e7cd90371e9d695bb
SHA512 84ec932cf4d8883d82fbb7c299c9acdc0b3dd4e27c4ce970bc9d7abdc71e64824cab5e05074774671b248f145ac47883fdcc22997875b0ee74b6e579ba5b91cf
SSDEEP 49152:yENwzIR257BYIqR6FoRvku04YLbeW4SkZP4sz9Mb:ygwkQ7aIqMe2fkZc
TLSH
T12FD54910F6608126F5F391B5CAEEA2ACF9353CA0476440CB61C9B7FD1A366E15D3236B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1236	USBMonitorSrv.exe
1200	host.exe
2556	Daemon.exe
4256	Daemon.exe
2396	Daemon.exe
3620	Daemon.exe
4760	Daemon.exe
4040	Daemon.exe
2180	Daemon.exe
4444	Daemon.exe
3504	Daemon.exe
2008	Daemon.exe
2948	Daemon.exe
816	Daemon.exe
6076	Daemon.exe
996	Daemon.exe
1172	Daemon.exe
4816	Daemon.exe
5532	Daemon.exe
3712	Daemon.exe
4948	Daemon.exe
880	Daemon.exe
4212	Daemon.exe
5448	Daemon.exe
4532	Daemon.exe
1592	Daemon.exe
3068	Daemon.exe
5328	Daemon.exe
5932	Daemon.exe
4672	Daemon.exe
5192	Daemon.exe
1680	Daemon.exe
376	Daemon.exe
1608	Daemon.exe
2404	Daemon.exe
5240	Daemon.exe
5472	Daemon.exe
2604	Daemon.exe
3016	Daemon.exe
3744	Daemon.exe
2900	Daemon.exe
5864	Daemon.exe
2916	Daemon.exe
552	Daemon.exe
4392	Daemon.exe
4956	Daemon.exe
5828	Daemon.exe
2360	Daemon.exe
3008	Daemon.exe
2172	Daemon.exe
4312	Daemon.exe
4640	Daemon.exe
2432	Daemon.exe
1864	Daemon.exe
2512	Daemon.exe
6000	Daemon.exe
2960	Daemon.exe
1908	Daemon.exe
3328	Daemon.exe
5884	Daemon.exe
2464	Daemon.exe
624	Daemon.exe
1796	Daemon.exe
1936	Daemon.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\copied.exe	yyzUSB.exe
File created	C:\Windows\SysWOW64\host.exe	yyzUSB.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	Process not Found
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	Process not Found
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	Process not Found
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	Process not Found
File created	C:\Windows\SysWOW64\copied.exe	yyzUSB.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	Process not Found
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	Process not Found
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	Process not Found
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	Process not Found
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	Process not Found
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	Process not Found
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	Process not Found
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	Process not Found
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	Process not Found
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	Process not Found
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	Process not Found

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yyzUSB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBMonitorSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBMonitorSrv.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1200	host.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1200	host.exe
Token: 35	1200	host.exe
Token: SeRestorePrivilege	14716	Process not Found
Token: 35	14716	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6032 wrote to memory of 1236	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	85
PID 6032 wrote to memory of 1200	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	86
PID 6032 wrote to memory of 996	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	87
PID 6032 wrote to memory of 6076	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	88
PID 6032 wrote to memory of 816	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	89
PID 6032 wrote to memory of 2948	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	90
PID 6032 wrote to memory of 2008	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	91
PID 6032 wrote to memory of 3504	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	92
PID 6032 wrote to memory of 4444	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	93
PID 6032 wrote to memory of 2180	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	94
PID 6032 wrote to memory of 4040	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	95
PID 6032 wrote to memory of 4760	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	96
PID 6032 wrote to memory of 3620	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	97
PID 6032 wrote to memory of 2396	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	98
PID 6032 wrote to memory of 4256	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	99
PID 6032 wrote to memory of 2556	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	100
PID 6032 wrote to memory of 1172	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	101
PID 6032 wrote to memory of 4816	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	102
PID 6032 wrote to memory of 5532	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	103
PID 6032 wrote to memory of 3712	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	104
PID 6032 wrote to memory of 4948	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	105
PID 6032 wrote to memory of 880	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	106
PID 6032 wrote to memory of 4212	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	107
PID 6032 wrote to memory of 5448	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	108
PID 6032 wrote to memory of 1592	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	109
PID 6032 wrote to memory of 4532	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	110
PID 6032 wrote to memory of 3068	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	111
PID 6032 wrote to memory of 5328	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	112
PID 6032 wrote to memory of 5932	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	113
PID 6032 wrote to memory of 4672	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	114
PID 6032 wrote to memory of 5192	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	115
PID 6032 wrote to memory of 1680	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	116
PID 6032 wrote to memory of 376	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	117
PID 6032 wrote to memory of 1608	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	118
PID 6032 wrote to memory of 2404	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	119
PID 6032 wrote to memory of 5240	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	120
PID 6032 wrote to memory of 5472	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	121
PID 6032 wrote to memory of 2604	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	122
PID 6032 wrote to memory of 3016	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	123
PID 6032 wrote to memory of 3744	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	124
PID 6032 wrote to memory of 2900	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	125
PID 6032 wrote to memory of 5864	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	126
PID 6032 wrote to memory of 2916	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	127
PID 6032 wrote to memory of 552	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	128
PID 6032 wrote to memory of 4392	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	129
PID 6032 wrote to memory of 4956	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	130
PID 6032 wrote to memory of 5828	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	131
PID 6032 wrote to memory of 2360	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	132
PID 6032 wrote to memory of 3008	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	133
PID 6032 wrote to memory of 2172	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	134
PID 6032 wrote to memory of 4312	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	135
PID 6032 wrote to memory of 4640	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	136
PID 6032 wrote to memory of 2432	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	137
PID 6032 wrote to memory of 1864	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	138
PID 6032 wrote to memory of 2512	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	139
PID 6032 wrote to memory of 6000	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	140
PID 6032 wrote to memory of 2960	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	141
PID 6032 wrote to memory of 1908	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	142
PID 6032 wrote to memory of 3328	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	143
PID 6032 wrote to memory of 5884	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	144
PID 6032 wrote to memory of 2464	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	145
PID 6032 wrote to memory of 624	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	146
PID 6032 wrote to memory of 1796	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	147
PID 6032 wrote to memory of 1936	6032	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	148

C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6032
- C:\USBMonitorSrv.exe
  /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1236
- C:\Users\Admin\AppData\Local\Temp\host.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:6076
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2556
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5532
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5448
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5328
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5192
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5240
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5472
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5828
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:6000
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5884
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3028
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5696
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5160
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5580
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6072
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2468
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4936
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5368
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:392
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2732
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1448
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:964
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1792
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5936
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1832
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5740
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3332
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5772
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5256
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5208
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5852
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5320
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1220
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6140
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5288
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5032
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5184
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1088
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5096
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4140
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1420
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5336
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5900
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4244
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1468
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1192
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4900
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4472
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2324
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3344
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:432
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2312
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5908
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4336
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5620
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2868
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3568
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1304
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5564
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6040
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:204
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2656
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4292
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3104
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3312
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3360
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2208
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5388
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4648
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4524
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4168
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1160
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2424
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5284
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2216
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5944
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4136
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5444
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5464
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3920
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2820
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5668
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:740
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2636
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:404
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3208
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4288
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5312
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4032
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4228
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2032
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2592
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2012
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3448
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3724
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3000
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1520
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3696
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4848
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4944
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5212
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5940
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3112
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1628
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2184
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3184
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5392
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5384
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5516
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5976
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4580
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4420
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4652
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:652
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4668
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4776
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6156
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6172
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6188
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6196
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6204
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6212
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6224
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6232
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6240
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6252
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6272
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6280
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6292
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6300
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6308
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6316
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6332
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6348
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6360
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6368
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6376
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6388
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6416
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6428
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6436
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6444
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6464
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6472
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6484
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6500
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6520
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6528
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6540
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6552
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6560
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6568
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6580
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6596
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6608
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6620
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6628
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6636
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6648
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6656
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6676
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6696
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6724
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6732
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6756
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6764
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6772
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6784
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6792
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6812
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6832
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6840
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6852
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6860
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6868
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6884
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6892
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6900
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6920
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6936
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6964
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7004
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7012
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7020
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7028
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7052
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7068
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7076
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7116
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7124
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7140
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7156
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6048
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7176
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7184
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7192
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7200
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7208
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7216
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7224
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7232
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7240
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7248
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7256
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7272
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7280
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7288
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7296
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7304
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7312
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7320
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7328
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7336
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7344
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7352
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7360
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7368
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7376
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7384
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7392
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7416
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7424
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7432
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7448
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7456
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7464
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7472
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7480
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7488
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7496
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7504
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7516
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7524
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7532
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7540
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7552
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7560
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7568
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7576
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7592
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7608
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7616
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7628
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7636
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7648
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7660
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7668
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7676
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7696
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7756
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7764
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7772
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7784
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7796
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7812
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7832
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7840
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7852
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7892
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7900
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7908
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7940
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7976
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7984
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:7996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8016
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8024
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8052
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8064
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8072
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8120
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8128
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8136
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8160
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8168
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8176
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8184
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3288
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8204
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8216
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8224
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8232
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8240
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8252
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8260
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8268
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8280
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8292
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8300
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8308
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8320
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8328
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8336
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8344
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8356
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8368
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8376
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8384
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8396
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8404
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8412
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8420
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8432
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8444
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8460
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8472
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8480
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8488
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8496
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8520
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8528
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8536
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8548
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8556
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8564
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8584
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8596
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8604
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8612
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8640
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8648
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8732
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8740
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8748
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8768
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8776
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8796
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8832
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8840
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8848
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8856
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8904
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8920
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8936
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8944
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8952
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8960
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8976
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8984
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:8992
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9000
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9020
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9028
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9048
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9056
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9064
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9076
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9116
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9124
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9140
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9156
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9172
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9188
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9196
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9204
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9212
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4064
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4740
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2964
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9220
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9228
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9240
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9248
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9256
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9268
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9276
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9284
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9292
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9300
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9308
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9316
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9324
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9332
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9352
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9360
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9368
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9376
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9384
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9392
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9416
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9424
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9432
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9448
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9456
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9464
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9472
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9480
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9488
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9496
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9504
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9520
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9528
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9536
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9544
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9552
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9560
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9568
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9576
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9584
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9592
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9608
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9616
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9636
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9644
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9652
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9660
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9684
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9740
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9768
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9776
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9796
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9828
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9836
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9856
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9892
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9904
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9920
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9940
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9960
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:9996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10016
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10024
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10048
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10056
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10064
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10076
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10104
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10112
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10124
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10140
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10152
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10160
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10168
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10188
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10200
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10208
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10216
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10228
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3484
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5612
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5860
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10244
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10252
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10272
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10280
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10296
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10304
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10312
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10320
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10332
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10348
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10372
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10380
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10392
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10416
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10428
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10436
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10444
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10464
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10472
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10480
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10500
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10516
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10524
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10536
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10544
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10552
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10564
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10580
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10608
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10616
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10636
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10644
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10652
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10660
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10724
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10772
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10780
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10808
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10836
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10852
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10900
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10908
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10936
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10944
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10964
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:10992
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11000
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11020
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11028
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11056
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11064
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11072
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11112
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11120
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11128
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11136
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11156
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11176
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11184
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11192
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11200
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11212
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11220
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11228
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11248
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11256
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3056
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5536
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11268
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11276
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11284
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11296
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11304
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11312
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11324
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11332
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11352
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11360
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11368
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11380
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11388
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11396
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11416
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11424
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11436
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11444
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11460
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11472
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11480
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11488
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11500
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11516
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11524
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11536
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11544
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11552
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11564
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11580
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11592
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11608
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11616
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11628
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11636
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11644
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11652
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11660
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11724
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11764
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11772
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11808
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11828
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11836
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11852
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11892
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11900
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11908
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11920
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11936
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11944
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11964
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11976
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:11996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12004
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12016
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12024
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12032
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12040
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12052
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12068
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12080
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12088
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12096
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12116
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12124
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12144
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12152
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12160
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12168
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12188
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12196
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12208
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12216
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12224
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12232
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12244
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12252
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12260
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12268
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12280
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12296
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12304
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12312
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12324
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12332
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12348
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12356
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12368
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12376
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12384
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12396
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12404
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12412
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12420
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12432
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12448
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12456
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12468
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12476
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12484
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12500
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12524
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12532
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12540
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12548
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12560
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12568
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12576
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12596
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12604
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12616
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12640
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12652
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12660
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12684
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12748
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12756
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12764
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12776
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12784
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12792
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12808
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12832
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12840
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12848
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12856
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12892
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12900
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12908
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12920
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12936
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12944
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12952
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12964
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:12996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13004
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13012
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13020
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13032
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13040
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13048
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13056
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13068
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13076
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13104
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13112
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13120
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13140
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13156
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13168
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13176
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13184
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:13192

C:\USBMonitorSrv.exe
C:\USBMonitorSrv.exe
1⤵
- System Location Discovery: System Language Discovery
PID:5296
- C:\yyzUSB.exe
  "C:\yyzUSB.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:14588
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Daemon.exe

Path C:\Daemon.exe
Size 454KB
SHA256 1d4a9e19b470570cf52676d3cad4dfb8880e7fba83df9a034792677c2f4c8e32
MD5 6175b5dc639ebb11fc708a67b4e7a3e3
SHA1 d8f5a80e548ec700cfa0b85293ea15e8b4141e8c
SHA512 8653c2fd4107cf636fca88446ce6bdc3262ad61376eb464096e2d1bf48d2b807c4e09c98fcd5a070f296d0e1314f8d8b3e439ec70697d3198a5f962e750b4007
SSDEEP 6144:G7JJY5Hebd8Rr6FoYpD6Ws0la8CFt4X8/nClI1wyhmz1q:WJY5HmqRr6FoYpDan8q+86lIyI
TLSH
T1D2A438016A60C029F3B673F46A6EE168945D7DB04768A4CFE1E57AF986301F26C3325F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

USBMonitorSrv.exe

Path C:\USBMonitorSrv.exe
Size 694KB
SHA256 f92c2d3b3f1df60b6401f697a05bd3e200a824a9aa2cc84a021963c911987c20
MD5 9ac3dc0ce15644d39b039527d942685c
SHA1 a08e14954fd47f58eeec36e9942a12557066c7d1
SHA512 360d31a9e66802a18610c8688be17c3bbf762db62c0f36a1b20477d42648bacbd8a0d50a54d05f1745fbb576c87878716242bdc2e7b81dff276e592d37182522
SSDEEP 12288:GHtTeTvIchy4LoLtlG8ZtwJ0ofJ2/5v7nL9Hwn6Lz:gCvz44sLy0aZJQ5Te6L
TLSH
T10FE45A10BB518429FDF751F54AFEA17C952C79B0DB9C20CB60C953EA463A6F02E36287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

copied.exe

Path C:\Windows\SysWOW64\copied.exe
Size 2.8MB
SHA256 040f463cecab71a73736f54868f75fb9a6c1663df88fe72c82d9de147e35394b
MD5 8ee7ca6bbbe7adcf81459a78400eb9b3
SHA1 210b8256b2d4a5ecb7912a6e7cd90371e9d695bb
SHA512 84ec932cf4d8883d82fbb7c299c9acdc0b3dd4e27c4ce970bc9d7abdc71e64824cab5e05074774671b248f145ac47883fdcc22997875b0ee74b6e579ba5b91cf
SSDEEP 49152:yENwzIR257BYIqR6FoRvku04YLbeW4SkZP4sz9Mb:ygwkQ7aIqMe2fkZc
TLSH
T12FD54910F6608126F5F391B5CAEEA2ACF9353CA0476440CB61C9B7FD1A366E15D3236B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host.exe

Path C:\Windows\SysWOW64\host.exe
Size 847KB
SHA256 e81b44ee7381ae3b630488b6fb7e3d9ffbdd9ac3032181d4ccaaff3409b57316
MD5 c8f40f25f783a52262bdaedeb5555427
SHA1 e45e198607c8d7398745baa71780e3e7a2f6deca
SHA512 f5944743f54028eb1dd0f2d68468726b177d33185324da0da96cdd20768bab4ca2e507ae9157b2733fd6240c920b7e15a5f5b9f284ee09d0fd385fc895b97191
SSDEEP 12288:9pnF6Ee+Rp4tqkWjQ+iOklku0/04gNphgBBO75nONT3vx2zVP:nZe0p4Ek4niOkl/A04szE87JKTvm
TLSH
T1CE05B759F5788323D0B3D0BAC5D7BA99FD3230455B308ACB024AD76C2E276D68636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.log

Path C:\service.log
Size 277B
SHA256 3d6dfa4983ab605c44e7d780494cd30a4a623be079c3f638209afb77e2e42f7e
MD5 2d8d46f62ea85cc8a760018cda858111
SHA1 f5bd77731c9545df8dae1bda7d7c77f28f14557c
SHA512 c94b20386d186c57662954046302f98ef794645b8e205d14dcfe04e34542376cbd24814b8da4f3526512d95cd7a4575caa4e34df8d1d860f48bc85c2046a8f3b
TLSH
T127D05E4419C80AF3C6C2392A8E9323D5CF473229193CB49143FA3E2D20CEE0D602C693
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\service.log
Size 429B
SHA256 171da03a9f45497a5f9bb2ba9565a9df28866664ffea1d9c5ad47a8ab991a974
MD5 95f3e9abe40a0292ef43ed2b4d79b8e0
SHA1 8eb20becd17a64a67ec01262aad9f39fd33b54ac
SHA512 e7a923a71ba84dabed2ce14ca67a3a66b2c2624cd23975fb924f2118817e700624e0c61ece6d4d8eac6de901c7b605ba6b8c109d7f114faf76cb1a2e7fc8af76
TLSH
T199E0ED4114C816F3C6C22429AEA32388DF9B32281C3CB09143FA3D2D20DBD0D6068286
MD5 SHA1 SHA512 TLSH

Submit Download

memory/204-302-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/376-353-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/432-286-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/552-361-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/816-276-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/880-296-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/964-323-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/996-279-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/1100-330-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/1172-280-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/1192-331-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/1236-277-0x0000000000EB0000-0x0000000000FA6000-memory.dmp

Download

memory/1304-311-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/1420-328-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/1448-308-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/1468-278-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/1508-307-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/1592-283-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/1608-351-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/1624-335-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/1680-349-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/1716-341-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/2008-291-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/2180-274-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/2208-309-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/2312-347-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/2324-305-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/2396-270-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/2464-340-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/2468-322-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/2604-355-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/2632-314-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/2656-334-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/2844-315-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/2868-346-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/2900-358-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/2916-360-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/2948-275-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/3016-356-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/3036-343-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/3068-284-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/3104-348-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/3312-299-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/3344-332-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/3504-290-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/3568-287-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/3620-271-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/3712-294-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/3744-357-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/3752-345-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/3864-327-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/3912-306-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/4040-273-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/4108-288-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/4140-326-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/4212-297-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/4256-269-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/4336-300-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/4392-362-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/4472-304-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/4532-282-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/4648-310-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/4672-352-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/4680-333-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/4760-272-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/4816-281-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/4948-295-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5032-324-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5044-313-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5192-319-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5240-301-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5256-317-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5264-303-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5288-325-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5328-285-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5400-316-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5448-298-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5472-354-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5532-293-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5580-318-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5708-339-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5736-312-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5740-344-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5828-321-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5864-359-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5888-336-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5900-338-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/5948-342-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/6032-9-0x0000000000122000-0x0000000000123000-memory.dmp

Download

memory/6032-8-0x0000000000010000-0x000000000032C000-memory.dmp

Download

memory/6040-337-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/6072-320-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/6076-292-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/6092-329-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/6100-289-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/6140-350-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads