040f463cecab71a73736f54868f75fb9a6c1663df88fe72c82d9de147e35394b

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe
Size 2.8MB
Sample261024-fppleafy7w
SHA256 040f463cecab71a73736f54868f75fb9a6c1663df88fe72c82d9de147e35394b
MD5 8ee7ca6bbbe7adcf81459a78400eb9b3
SHA1 210b8256b2d4a5ecb7912a6e7cd90371e9d695bb
SHA512 84ec932cf4d8883d82fbb7c299c9acdc0b3dd4e27c4ce970bc9d7abdc71e64824cab5e05074774671b248f145ac47883fdcc22997875b0ee74b6e579ba5b91cf
SSDEEP 49152:yENwzIR257BYIqR6FoRvku04YLbeW4SkZP4sz9Mb:ygwkQ7aIqMe2fkZc
TLSH
T12FD54910F6608126F5F391B5CAEEA2ACF9353CA0476440CB61C9B7FD1A366E15D3236B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5564	USBMonitorSrv.exe
3324	Daemon.exe
676	Daemon.exe
5720	Daemon.exe
5076	Daemon.exe
4236	Daemon.exe
4980	Daemon.exe
2404	Daemon.exe
2128	Daemon.exe
5980	Daemon.exe
3672	Daemon.exe
1204	Daemon.exe
696	Daemon.exe
1748	Daemon.exe
5060	Daemon.exe
1552	Daemon.exe
1272	Daemon.exe
5488	Daemon.exe
1324	Daemon.exe
3848	Daemon.exe
6060	Daemon.exe
2896	Daemon.exe
4884	Daemon.exe
1744	Daemon.exe
4272	Daemon.exe
4860	Daemon.exe
4900	Daemon.exe
2704	Daemon.exe
3276	Daemon.exe
4344	Daemon.exe
3548	Daemon.exe
1780	Daemon.exe
2684	Daemon.exe
4348	Daemon.exe
2816	Daemon.exe
3420	Daemon.exe
4832	Daemon.exe
6016	Daemon.exe
5400	Daemon.exe
5888	Daemon.exe
4812	Daemon.exe
1668	Daemon.exe
3460	Daemon.exe
5996	Daemon.exe
1968	Daemon.exe
296	Daemon.exe
244	Daemon.exe
236	Daemon.exe
5464	Daemon.exe
3252	Daemon.exe
4704	Daemon.exe
1948	Daemon.exe
3772	Daemon.exe
1396	Daemon.exe
4216	Daemon.exe
3412	Daemon.exe
3896	Daemon.exe
3084	Daemon.exe
1956	Daemon.exe
3372	Daemon.exe
5164	Daemon.exe
1824	Daemon.exe
2056	Daemon.exe
3188	Daemon.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	host.exe
File created	C:\Windows\SysWOW64\host.exe	yyzUSB.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	host.exe
File created	C:\Windows\SysWOW64\copied.exe	yyzUSB.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	host.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	host.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBMonitorSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBMonitorSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yyzUSB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	host.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6516	host.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	6516	host.exe
Token: 35	6516	host.exe
Token: SeRestorePrivilege	12312	host.exe
Token: 35	12312	host.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 5564	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	90
PID 3312 wrote to memory of 3324	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	92
PID 3312 wrote to memory of 676	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	93
PID 3312 wrote to memory of 5720	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	94
PID 3312 wrote to memory of 5076	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	95
PID 3312 wrote to memory of 4236	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	96
PID 3312 wrote to memory of 4980	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	97
PID 3312 wrote to memory of 2404	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	98
PID 3312 wrote to memory of 2128	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	99
PID 3312 wrote to memory of 5980	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	100
PID 3312 wrote to memory of 3672	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	101
PID 3312 wrote to memory of 1204	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	102
PID 3312 wrote to memory of 696	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	103
PID 3312 wrote to memory of 1748	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	104
PID 3312 wrote to memory of 5060	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	105
PID 3312 wrote to memory of 1552	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	106
PID 3312 wrote to memory of 1272	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	107
PID 3312 wrote to memory of 5488	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	108
PID 3312 wrote to memory of 1324	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	109
PID 3312 wrote to memory of 3848	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	110
PID 3312 wrote to memory of 6060	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	111
PID 3312 wrote to memory of 2896	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	112
PID 3312 wrote to memory of 4884	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	113
PID 3312 wrote to memory of 1744	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	114
PID 3312 wrote to memory of 4860	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	115
PID 3312 wrote to memory of 4272	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	116
PID 3312 wrote to memory of 4900	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	117
PID 3312 wrote to memory of 2704	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	118
PID 3312 wrote to memory of 3276	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	119
PID 3312 wrote to memory of 4344	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	120
PID 3312 wrote to memory of 3548	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	121
PID 3312 wrote to memory of 1780	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	122
PID 3312 wrote to memory of 2684	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	123
PID 3312 wrote to memory of 4348	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	124
PID 3312 wrote to memory of 2816	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	125
PID 3312 wrote to memory of 3420	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	126
PID 3312 wrote to memory of 4832	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	127
PID 3312 wrote to memory of 6016	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	128
PID 3312 wrote to memory of 5400	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	129
PID 3312 wrote to memory of 4888	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	130
PID 3312 wrote to memory of 4812	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	131
PID 3312 wrote to memory of 3248	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	132
PID 3312 wrote to memory of 5888	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	133
PID 3312 wrote to memory of 4500	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	134
PID 3312 wrote to memory of 4872	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	135
PID 3312 wrote to memory of 1712	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	136
PID 3312 wrote to memory of 1668	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	137
PID 3312 wrote to memory of 3460	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	138
PID 3312 wrote to memory of 5996	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	139
PID 3312 wrote to memory of 1968	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	140
PID 3312 wrote to memory of 296	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	141
PID 3312 wrote to memory of 244	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	142
PID 3312 wrote to memory of 236	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	143
PID 3312 wrote to memory of 3252	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	144
PID 3312 wrote to memory of 5464	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	145
PID 3312 wrote to memory of 4704	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	146
PID 3312 wrote to memory of 1948	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	147
PID 3312 wrote to memory of 3772	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	148
PID 3312 wrote to memory of 1396	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	149
PID 3312 wrote to memory of 4216	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	150
PID 3312 wrote to memory of 3412	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	151
PID 3312 wrote to memory of 3896	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	152
PID 3312 wrote to memory of 1956	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	153
PID 3312 wrote to memory of 3084	3312	2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe	154

C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3312
- C:\USBMonitorSrv.exe
  /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5564
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3324
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5488
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:6060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:6016
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3248
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4500
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:244
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5464
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4200
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4444
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5504
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5500
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3392
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1496
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4232
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4316
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1284
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1556
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5220
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2540
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:904
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3020
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1920
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5260
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1080
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3544
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2668
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2416
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5640
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2856
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4496
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4476
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4544
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5868
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:808
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3828
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3764
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1460
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5300
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4372
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5104
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2596
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1376
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5976
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3376
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1484
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5116
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4256
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4328
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5776
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5100
- C:\Users\Admin\AppData\Local\Temp\host.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_8ee7ca6bbbe7adcf81459a78400eb9b3_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:6516

C:\USBMonitorSrv.exe
C:\USBMonitorSrv.exe
1⤵
- System Location Discovery: System Language Discovery
PID:7036
- C:\yyzUSB.exe
  "C:\yyzUSB.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:7124
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5912
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4624
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4324
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4892
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4152
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3100
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:884
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4840
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5724
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4928
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2472
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5368
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5472
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5372
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4560
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5276
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2140
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4684
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5872
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5068
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2924
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3524
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:716
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1296
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:916
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2448
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5252
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2688
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5044
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3144
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5492
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6176
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6192
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6204
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6220
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6236
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6256
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6272
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6284
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6304
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6316
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6336
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6352
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6364
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6380
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6396
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6420
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6448
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6464
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6476
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2644
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6496
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1044
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:876
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3356
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3092
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4816
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1944
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3700
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2040
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1392
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2652
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6580
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3152
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5108
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1268
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2476
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4552
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1516
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5748
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5876
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2488
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2484
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1660
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1676
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5936
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4376
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2972
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6428
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3056
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3336
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4004
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4848
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4240
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4924
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1476
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6776
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4172
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6788
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6796
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6804
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6812
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6820
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6828
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6836
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6844
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6852
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6856
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6864
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6872
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6880
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6888
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6896
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6904
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6912
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5708
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6924
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6932
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6940
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6948
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6956
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6960
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6968
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6972
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3476
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4616
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6980
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:944
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3508
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1812
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4620
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1560
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2512
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2768
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1900
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2092
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2188
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:984
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2544
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4396
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1664
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3484
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6148
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6168
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6184
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6196
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6212
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6228
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6244
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6264
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6280
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6292
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6308
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6324
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6340
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6356
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6372
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6388
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6404
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6432
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6456
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6480
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6492
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6504
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6508
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1976
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4868
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3268
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4140
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1316
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:948
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4276
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2016
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4212
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5712
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7172
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7180
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7188
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7196
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7204
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7212
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7220
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7228
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7236
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7244
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7252
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7260
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7268
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7276
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7284
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7292
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7300
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7308
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7316
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7324
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7332
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7340
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7348
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7356
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7364
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7372
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7380
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7388
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7396
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7404
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7412
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7420
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7428
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7436
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7444
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7452
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7460
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7468
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7476
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7484
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7492
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7500
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7508
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7516
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7524
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7532
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7540
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7548
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7556
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7564
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7572
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7580
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7588
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7596
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7604
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7612
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7620
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7628
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7636
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7644
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7652
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7660
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7668
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7676
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7684
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7692
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7700
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7708
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7716
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7724
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7732
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7740
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7748
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7756
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7764
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7772
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7780
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7788
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7796
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7804
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7812
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7820
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7828
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7836
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7844
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7852
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7860
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7868
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7876
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7884
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7892
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7900
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7908
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7916
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7924
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7932
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7940
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7948
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7956
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7964
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7972
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7980
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7988
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7996
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8004
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8012
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8020
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8028
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8036
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8044
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8052
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8060
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8068
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8076
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8084
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8092
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8100
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8108
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8116
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8124
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8132
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8140
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8148
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8168
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8176
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8184
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7028
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2224
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8200
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8208
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8216
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8224
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8232
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8240
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8248
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8256
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8264
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8272
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8280
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8288
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8296
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8304
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8312
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8320
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8328
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8336
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8344
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8352
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8360
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8368
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8376
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8384
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8392
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8400
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8408
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8416
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8424
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8432
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8440
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8448
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8456
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8464
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8472
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8480
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8488
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8496
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8504
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8512
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8520
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8528
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8536
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8544
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8552
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8560
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8568
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8576
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8584
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8592
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8600
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8608
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8616
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8624
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8632
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8640
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8648
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8656
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8664
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8672
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8680
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8688
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8696
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8704
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8712
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8720
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8728
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8736
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8744
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8752
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8760
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8768
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8776
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8784
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8792
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8800
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8808
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8816
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8824
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8832
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8840
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8848
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8856
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8864
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8872
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8880
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8888
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8896
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8904
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8912
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8920
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8928
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8936
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8944
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8952
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8960
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8968
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8976
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8984
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8992
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9000
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9008
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9016
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9024
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9032
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9040
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9048
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9056
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9064
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9072
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9080
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9088
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9096
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9104
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9112
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9120
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9128
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9136
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9144
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9152
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9168
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9176
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9184
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9192
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9200
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9208
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:404
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2036
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9224
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9232
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9240
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9248
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9256
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9264
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9272
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9280
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9288
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9296
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9304
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9312
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9320
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9328
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9336
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9344
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9352
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9360
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9368
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9376
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9384
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9392
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9400
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9408
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9416
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9424
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9432
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9440
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9448
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9456
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9464
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9472
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9480
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9488
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9496
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9504
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9512
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9520
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9528
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9536
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9544
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9552
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9560
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9568
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9576
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9584
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9592
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9600
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9608
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9616
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9624
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9632
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9640
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9648
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9656
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9664
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9672
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9680
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9688
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9696
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9704
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9712
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9720
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9728
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9736
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9744
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9752
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9760
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9768
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9776
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9784
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9792
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9800
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9808
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9816
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9824
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9832
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9840
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9848
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9856
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9864
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9872
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9880
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9888
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9896
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9904
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9912
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9920
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9928
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9936
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9944
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9952
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9960
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9968
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9976
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9984
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9992
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10000
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10008
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10016
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10024
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10032
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10048
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10056
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10064
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10072
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10080
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10088
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10096
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10104
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10112
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10120
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10128
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10136
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10144
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10152
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10168
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10176
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10184
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10192
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10200
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10208
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10216
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10224
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10232
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2844
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7032
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2612
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4748
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:988
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7060
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1440
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7084
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7096
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7104
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7116
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6576
- - C:\Windows\SysWOW64\host.exe
    "C:\yyzUSB.exe"
    3⤵
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    PID:12312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Daemon.exe

Path C:\Daemon.exe
Size 454KB
SHA256 1d4a9e19b470570cf52676d3cad4dfb8880e7fba83df9a034792677c2f4c8e32
MD5 6175b5dc639ebb11fc708a67b4e7a3e3
SHA1 d8f5a80e548ec700cfa0b85293ea15e8b4141e8c
SHA512 8653c2fd4107cf636fca88446ce6bdc3262ad61376eb464096e2d1bf48d2b807c4e09c98fcd5a070f296d0e1314f8d8b3e439ec70697d3198a5f962e750b4007
SSDEEP 6144:G7JJY5Hebd8Rr6FoYpD6Ws0la8CFt4X8/nClI1wyhmz1q:WJY5HmqRr6FoYpDan8q+86lIyI
TLSH
T1D2A438016A60C029F3B673F46A6EE168945D7DB04768A4CFE1E57AF986301F26C3325F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

USBMonitorSrv.exe

Path C:\USBMonitorSrv.exe
Size 694KB
SHA256 f92c2d3b3f1df60b6401f697a05bd3e200a824a9aa2cc84a021963c911987c20
MD5 9ac3dc0ce15644d39b039527d942685c
SHA1 a08e14954fd47f58eeec36e9942a12557066c7d1
SHA512 360d31a9e66802a18610c8688be17c3bbf762db62c0f36a1b20477d42648bacbd8a0d50a54d05f1745fbb576c87878716242bdc2e7b81dff276e592d37182522
SSDEEP 12288:GHtTeTvIchy4LoLtlG8ZtwJ0ofJ2/5v7nL9Hwn6Lz:gCvz44sLy0aZJQ5Te6L
TLSH
T10FE45A10BB518429FDF751F54AFEA17C952C79B0DB9C20CB60C953EA463A6F02E36287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host.exe

Path C:\Windows\SysWOW64\host.exe
Size 847KB
SHA256 e81b44ee7381ae3b630488b6fb7e3d9ffbdd9ac3032181d4ccaaff3409b57316
MD5 c8f40f25f783a52262bdaedeb5555427
SHA1 e45e198607c8d7398745baa71780e3e7a2f6deca
SHA512 f5944743f54028eb1dd0f2d68468726b177d33185324da0da96cdd20768bab4ca2e507ae9157b2733fd6240c920b7e15a5f5b9f284ee09d0fd385fc895b97191
SSDEEP 12288:9pnF6Ee+Rp4tqkWjQ+iOklku0/04gNphgBBO75nONT3vx2zVP:nZe0p4Ek4niOkl/A04szE87JKTvm
TLSH
T1CE05B759F5788323D0B3D0BAC5D7BA99FD3230455B308ACB024AD76C2E276D68636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.log

Path C:\service.log
Size 429B
SHA256 171da03a9f45497a5f9bb2ba9565a9df28866664ffea1d9c5ad47a8ab991a974
MD5 95f3e9abe40a0292ef43ed2b4d79b8e0
SHA1 8eb20becd17a64a67ec01262aad9f39fd33b54ac
SHA512 e7a923a71ba84dabed2ce14ca67a3a66b2c2624cd23975fb924f2118817e700624e0c61ece6d4d8eac6de901c7b605ba6b8c109d7f114faf76cb1a2e7fc8af76
TLSH
T199E0ED4114C816F3C6C22429AEA32388DF9B32281C3CB09143FA3D2D20DBD0D6068286
MD5 SHA1 SHA512 TLSH

Submit Download

memory/236-158-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/244-157-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/296-156-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/676-120-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/696-122-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/904-183-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/1204-121-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/1272-125-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/1284-185-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/1324-145-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/1324-127-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/1396-164-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/1552-152-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/1552-124-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/1556-169-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/1624-201-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/1744-129-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/1752-189-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/1780-137-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/1920-194-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/1932-205-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/1948-162-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/1956-208-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/1968-155-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/1980-181-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/2044-179-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/2056-168-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/2128-165-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/2404-138-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/2416-172-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/2540-182-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/2668-173-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/2684-176-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/2816-178-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/2856-198-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/2968-180-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/3020-151-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/3084-204-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/3188-206-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/3252-160-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/3276-133-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/3312-4-0x0000000001092000-0x0000000001093000-memory.dmp

Download

memory/3312-3-0x0000000000F80000-0x000000000129C000-memory.dmp

Download

memory/3324-76-0x0000000000688000-0x0000000000689000-memory.dmp

Download

memory/3324-38-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/3372-210-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/3392-207-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/3460-143-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/3544-174-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/3672-140-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/3772-163-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/3804-199-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/3848-147-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/3896-209-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/3916-190-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4200-203-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4216-166-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4232-192-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4236-146-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4272-130-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4316-188-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4344-136-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4348-177-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4444-202-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4476-193-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4492-197-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4496-195-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4544-200-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4704-161-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4760-186-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4812-142-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4824-170-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4860-131-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4884-128-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4900-132-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4900-175-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/4980-135-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/5060-150-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/5060-123-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/5076-134-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/5164-167-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/5220-184-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/5260-191-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/5400-139-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/5464-159-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/5488-153-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/5488-126-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/5564-10-0x00000000005C0000-0x00000000006B6000-memory.dmp

Download

memory/5640-171-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/5664-187-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/5672-196-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/5720-144-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/5888-141-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/5980-148-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/5996-154-0x0000000000600000-0x000000000069C000-memory.dmp

Download

memory/6060-149-0x0000000000600000-0x000000000069C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads