1064bd173f7498c8cbb1c4a2c5211af1404cbca311001a7153cb18cd4c291e31

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe
Size 2.2MB
Sample261024-na9xsshv2y
SHA256 1064bd173f7498c8cbb1c4a2c5211af1404cbca311001a7153cb18cd4c291e31
MD5 61cf7ac470e407820efd61f7b86cf6a3
SHA1 c5c9712675582d48582f13d563b054eceea57818
SHA512 3d6a6a7f0726dd6ca88e1d075063b888b3f7980cc6c4c55db530418346fa5a6400bf1be8e9526ea98863656f2a40561909acffcef25ff7d30a99465fcfadc54f
SSDEEP 24576:VENJKEt6dq8hXj8R2vxW870KH/e5GqR6FokG81Cvz44sLy0aZJQ5Te6LnJIU3:VENwzIR257BWIqR6FoRvku04YLnJIU
TLSH
T1DDB56C21BB108464FAF752F55AEDE16896197CB08B9860CBB0D573FE4A366F02D33247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
872	USBMonitorSrv.exe
4444	host.exe
4668	Daemon.exe
840	Daemon.exe
1648	Daemon.exe
3884	Daemon.exe
2508	Daemon.exe
2796	Daemon.exe
3400	Daemon.exe
3460	Daemon.exe
1800	Daemon.exe
4692	Daemon.exe
4080	Daemon.exe
1684	Daemon.exe
3684	Daemon.exe
1996	Daemon.exe
1340	Daemon.exe
2800	Daemon.exe
4876	Daemon.exe
2968	Daemon.exe
4516	Daemon.exe
4424	Daemon.exe
892	Daemon.exe
4908	Daemon.exe
2980	Daemon.exe
2268	Daemon.exe
720	Daemon.exe
2076	Daemon.exe
3264	Daemon.exe
4644	Daemon.exe
4796	Daemon.exe
2544	Daemon.exe
4732	Daemon.exe
3768	Daemon.exe
2556	Daemon.exe
4528	Daemon.exe
1920	Daemon.exe
1532	Daemon.exe
3804	Daemon.exe
3008	Daemon.exe
4984	Daemon.exe
2056	Daemon.exe
4912	Daemon.exe
4972	Daemon.exe
2452	Daemon.exe
3908	Daemon.exe
1580	Daemon.exe
2380	Daemon.exe
4636	Daemon.exe
3128	Daemon.exe
452	Daemon.exe
4760	Daemon.exe
1896	Daemon.exe
3792	Daemon.exe
3532	Daemon.exe
2912	Daemon.exe
2428	Daemon.exe
3328	Daemon.exe
4036	Daemon.exe
2336	Daemon.exe
1300	Daemon.exe
640	Daemon.exe
2204	Daemon.exe
896	Daemon.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\copied.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\copied.exe	Process not Found
File created	C:\Windows\SysWOW64\host.exe	Process not Found

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBMonitorSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 872	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	84
PID 4120 wrote to memory of 4444	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	85
PID 4120 wrote to memory of 4668	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	86
PID 4120 wrote to memory of 840	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	87
PID 4120 wrote to memory of 1648	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	88
PID 4120 wrote to memory of 3884	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	89
PID 4120 wrote to memory of 2508	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	90
PID 4120 wrote to memory of 2796	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	91
PID 4120 wrote to memory of 3400	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	92
PID 4120 wrote to memory of 3460	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	93
PID 4120 wrote to memory of 1800	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	94
PID 4120 wrote to memory of 4692	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	95
PID 4120 wrote to memory of 4080	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	96
PID 4120 wrote to memory of 1684	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	97
PID 4120 wrote to memory of 3684	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	98
PID 4120 wrote to memory of 1996	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	99
PID 4120 wrote to memory of 1340	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	100
PID 4120 wrote to memory of 2800	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	101
PID 4120 wrote to memory of 4876	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	102
PID 4120 wrote to memory of 2968	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	103
PID 4120 wrote to memory of 4516	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	104
PID 4120 wrote to memory of 4424	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	105
PID 4120 wrote to memory of 892	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	106
PID 4120 wrote to memory of 4908	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	107
PID 4120 wrote to memory of 2980	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	108
PID 4120 wrote to memory of 2268	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	109
PID 4120 wrote to memory of 720	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	110
PID 4120 wrote to memory of 2076	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	111
PID 4120 wrote to memory of 3264	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	112
PID 4120 wrote to memory of 4644	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	113
PID 4120 wrote to memory of 4796	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	114
PID 4120 wrote to memory of 2544	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	115
PID 4120 wrote to memory of 4732	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	116
PID 4120 wrote to memory of 3768	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	117
PID 4120 wrote to memory of 2556	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	118
PID 4120 wrote to memory of 4528	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	119
PID 4120 wrote to memory of 1920	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	120
PID 4120 wrote to memory of 1532	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	121
PID 4120 wrote to memory of 3804	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	122
PID 4120 wrote to memory of 3008	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	123
PID 4120 wrote to memory of 4984	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	124
PID 4120 wrote to memory of 2056	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	125
PID 4120 wrote to memory of 4912	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	126
PID 4120 wrote to memory of 4972	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	127
PID 4120 wrote to memory of 2452	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	128
PID 4120 wrote to memory of 3908	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	129
PID 4120 wrote to memory of 1580	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	130
PID 4120 wrote to memory of 2380	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	131
PID 4120 wrote to memory of 4636	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	132
PID 4120 wrote to memory of 3128	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	133
PID 4120 wrote to memory of 452	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	134
PID 4120 wrote to memory of 4760	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	135
PID 4120 wrote to memory of 1896	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	136
PID 4120 wrote to memory of 3792	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	137
PID 4120 wrote to memory of 3532	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	138
PID 4120 wrote to memory of 2912	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	139
PID 4120 wrote to memory of 2428	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	140
PID 4120 wrote to memory of 3328	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	141
PID 4120 wrote to memory of 4036	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	142
PID 4120 wrote to memory of 2336	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	143
PID 4120 wrote to memory of 1300	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	144
PID 4120 wrote to memory of 640	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	145
PID 4120 wrote to memory of 2204	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	146
PID 4120 wrote to memory of 896	4120	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	147

C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120
- C:\USBMonitorSrv.exe
  /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:872
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3468
- C:\Users\Admin\AppData\Local\Temp\host.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4668
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1556
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:224
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:116
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2064
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4448
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3796
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1228
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5088
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1272
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2960
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4484
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4536
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3152
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:628
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2640
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2312
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:564
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4496
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3584
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2112
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4056
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4004
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4684
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4432
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:388
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2304
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3820
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2776
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4832
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2856
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3832
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:644
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1344
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1220
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3292
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2992
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1292
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:540
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3904
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1616
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4160
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2460
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4476
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1280
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3224
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2432
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4964
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1560
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4660
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4300
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2300
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3808
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3196
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1412
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:732
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2160
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4544
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3372
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1096
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4064
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4156
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3448
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3676
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4840
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1660
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3940
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3484
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5012
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1128
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1868
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5128
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5136
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5144
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5156
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5172
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5184
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5196
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5204
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5212
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5220
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5232
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5240
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5248
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5256
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5272
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5284
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5292
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5304
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5312
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5320
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5328
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5348
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5356
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5376
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5388
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5396
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5404
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5412
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5424
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5432
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5448
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5456
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5472
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5480
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5488
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5496
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5516
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5528
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5540
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5548
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5560
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5568
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5584
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5592
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5612
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5620
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5628
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5640
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5652
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5660
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5668
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5696
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5756
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5764
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5772
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5784
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5796
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5812
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5832
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5840
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5856
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5900
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5908
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5940
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5976
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5984
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6016
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6024
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6052
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6076
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6112
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6120
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6128
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6136
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1232
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6152
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6160
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6172
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6188
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6200
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6212
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6220
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6228
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6240
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6248
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6256
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6280
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6288
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6296
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6304
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6316
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6324
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6332
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6356
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6372
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6384
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6392
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6420
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6432
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6448
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6456
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6464
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6476
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6484
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6500
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6524
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6532
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6540
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6552
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6560
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6568
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6576
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6608
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6616
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6636
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6644
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6652
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6660
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6684
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6748
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6768
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6776
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6784
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6792
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6812
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6820
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6828
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6840
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6848
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6860
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6868
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6876
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6904
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6936
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6944
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6956
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6964
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7004
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7012
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7020
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7032
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7040
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7048
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7072
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7080
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7088
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7116
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7124
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7140
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7156
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4924
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1724
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7192
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7200
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7208
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7220
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7228
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7248
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7260
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7268
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7276
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7288
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7296
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7304
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7316
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7328
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7340
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7348
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7356
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7376
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7384
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7392
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7404
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7416
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7424
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7436
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7444
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7468
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7476
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7484
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7504
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7520
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7536
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7544
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7552
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7560
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7580
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7604
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7612
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7620
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7640
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7648
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7732
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7740
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7748
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7768
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7776
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7808
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7828
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7836
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7852
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7876
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7884
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7892
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7904
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7920
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7928
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7944
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7952
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7960
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:7996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8004
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8020
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8028
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8056
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8064
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8072
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8096
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8104
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8112
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8124
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8140
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8172
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8188
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8204
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8212
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8220
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8228
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8240
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8252
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8260
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8268
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8276
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8288
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8296
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8304
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8316
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8328
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8336
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8344
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8356
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8372
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8384
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8396
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8404
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8412
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8420
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8432
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8448
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8460
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8472
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8480
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8488
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8500
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8516
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8528
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8536
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8548
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8556
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8568
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8576
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8584
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8592
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8604
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8616
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8644
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8652
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8660
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8684
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8740
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8768
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8780
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8796
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8808
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8820
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8828
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8836
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8856
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8904
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8920
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8940
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8960
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:8988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9000
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9016
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9024
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9052
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9064
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9072
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9080
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9088
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9116
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9124
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9136
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9144
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9152
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9172
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9188
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9200
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9208
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3156
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:900
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2232
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9224
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9244
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9252
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9272
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9280
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9288
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9296
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9308
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9316
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9324
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9336
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9344
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9352
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9360
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9372
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9380
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9388
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9416
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9428
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9436
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9444
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9456
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9464
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9472
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9480
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9500
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9516
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9528
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9536
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9544
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9556
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9564
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9580
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9592
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9608
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9620
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9628
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9636
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9648
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9656
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9772
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9780
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9808
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9836
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9852
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9860
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9904
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9924
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9944
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9952
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9960
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:9996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10004
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10016
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10024
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10032
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10056
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10064
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10072
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10080
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10120
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10128
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10136
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10148
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10156
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10164
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10172
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10184
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10192
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10200
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10208
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10220
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10232
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3120
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3840
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10244
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10252
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10272
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10280
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10292
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10300
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10308
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10320
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10328
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10336
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10344
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10352
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10372
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10380
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10392
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10416
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10424
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10436
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10444
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10460
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10472
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10480
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10488
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10496
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10504
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10516
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10524
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10532
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10544
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10552
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10560
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10580
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10588
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10608
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10616
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10628
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10636
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10644
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10656
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10672
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10680
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10764
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10772
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10780
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10808
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10836
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10852
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10860
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10908
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10924
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10944
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10952
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10960
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10968
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:10996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11004
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11016
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11024
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11036
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11052
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11072
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11080
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11088
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11096
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11104
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11116
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11124
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11144
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11152
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11160
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11172
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11192
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11200
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11208
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11220
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11228
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11248
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11256
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2320
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:464
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4960
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2772
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1420
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11272
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11280
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11292
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11300
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11308
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11320
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11328
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11336
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11344
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11352
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11360
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11368
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11376
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11384
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11396
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11404
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11412
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11420
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11428
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11440
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11460
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11468
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11476
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11488
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11496
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11504
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11524
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11532
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11540
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11548
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11560
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11568
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11576
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11584
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11596
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11604
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11612
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11620
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11640
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11648
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11656
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11668
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11676
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11684
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11720
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11764
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11772
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11780
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11800
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11808
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11836
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11852
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11888
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11900
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11908
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11916
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11924
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11936
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11944
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11952
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11960
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:11988
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12000
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12016
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12024
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12032
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12052
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12068
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12080
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12088
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12096
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12108
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12116
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12124
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12136
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12144
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12152
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12160
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12172
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12188
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12196
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12208
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12216
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12224
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12244
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12252
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12272
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12280
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1832
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1984
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3668
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12292
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12304
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12312
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12320
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12328
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12336
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12348
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12356
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12376
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12384
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12392
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12420
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12428
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12436
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12448
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12456
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12464
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12472
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12480
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12488
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12496
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12504
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12512
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12520
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12528
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12536
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12544
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12552
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12560
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12568
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12576
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12584
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12592
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12608
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12616
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12640
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12648
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12656
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12664
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12676
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12684
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12692
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12724
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12732
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12740
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12752
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12760
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12768
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12780
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12796
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12804
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12832
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12844
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12852
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:12860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Daemon.exe

Path C:\Daemon.exe
Size 454KB
SHA256 1d4a9e19b470570cf52676d3cad4dfb8880e7fba83df9a034792677c2f4c8e32
MD5 6175b5dc639ebb11fc708a67b4e7a3e3
SHA1 d8f5a80e548ec700cfa0b85293ea15e8b4141e8c
SHA512 8653c2fd4107cf636fca88446ce6bdc3262ad61376eb464096e2d1bf48d2b807c4e09c98fcd5a070f296d0e1314f8d8b3e439ec70697d3198a5f962e750b4007
SSDEEP 6144:G7JJY5Hebd8Rr6FoYpD6Ws0la8CFt4X8/nClI1wyhmz1q:WJY5HmqRr6FoYpDan8q+86lIyI
TLSH
T1D2A438016A60C029F3B673F46A6EE168945D7DB04768A4CFE1E57AF986301F26C3325F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

USBMonitorSrv.exe

Path C:\USBMonitorSrv.exe
Size 694KB
SHA256 f92c2d3b3f1df60b6401f697a05bd3e200a824a9aa2cc84a021963c911987c20
MD5 9ac3dc0ce15644d39b039527d942685c
SHA1 a08e14954fd47f58eeec36e9942a12557066c7d1
SHA512 360d31a9e66802a18610c8688be17c3bbf762db62c0f36a1b20477d42648bacbd8a0d50a54d05f1745fbb576c87878716242bdc2e7b81dff276e592d37182522
SSDEEP 12288:GHtTeTvIchy4LoLtlG8ZtwJ0ofJ2/5v7nL9Hwn6Lz:gCvz44sLy0aZJQ5Te6L
TLSH
T10FE45A10BB518429FDF751F54AFEA17C952C79B0DB9C20CB60C953EA463A6F02E36287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

copied.exe

Path C:\Windows\SysWOW64\copied.exe
Size 2.2MB
SHA256 1064bd173f7498c8cbb1c4a2c5211af1404cbca311001a7153cb18cd4c291e31
MD5 61cf7ac470e407820efd61f7b86cf6a3
SHA1 c5c9712675582d48582f13d563b054eceea57818
SHA512 3d6a6a7f0726dd6ca88e1d075063b888b3f7980cc6c4c55db530418346fa5a6400bf1be8e9526ea98863656f2a40561909acffcef25ff7d30a99465fcfadc54f
SSDEEP 24576:VENJKEt6dq8hXj8R2vxW870KH/e5GqR6FokG81Cvz44sLy0aZJQ5Te6LnJIU3:VENwzIR257BWIqR6FoRvku04YLnJIU
TLSH
T1DDB56C21BB108464FAF752F55AEDE16896197CB08B9860CBB0D573FE4A366F02D33247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host.exe

Path C:\Windows\SysWOW64\host.exe
Size 281KB
SHA256 6d54694077faf07473196da7b7f1c6981c8ad6a462fcea4777a80cfc6bc5769e
MD5 3dc3594fb3b25c55081fe4b3226abbc2
SHA1 7eaddfd597fc76244f71f98877f7149c9e85dc9e
SHA512 8f268673c86e2c38d1713696ed25b75a565d8beb5b05ea755c9cbb12f625b8d4abfc1bb3f9f54c297ba4bd7dd9e465737c30f492aaef0034b0e1568ce13d2445
SSDEEP 6144:zOOr/BJ/GKWWBNU6ITLBi0qttclOKgU91Bg:meBNUbTVO86Uq
TLSH
T11254E73BEE28FCD2C27A8DB85A918640E77274704B61A3CBD175830EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.log

Path C:\service.log
Size 299B
SHA256 8825a6bbbdb4a8de7618139a0f4f0c8afc097cd1568906684b9efe587bf888f6
MD5 7d22c15d6b9ffd239c3a624a521ae42c
SHA1 d9ebfabba0e7071abb3394cd150cb116c0027051
SHA512 c4c3ff8058698a8170d1b98b566915c20657c9cad9213b0c83c7bc5c0db4dbc923d72a1cfcfd0fd20b44eb6a40663cf76d197be446cb66170fbd3c4fb18d10aa
TLSH
T113E0C24010C806F3C7C734199E4323C5CF037059187CB0A003FA7D2920CAD0D2078682
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\service.log
Size 433B
SHA256 b05f545528de2e6100c51815865d575dfb53aff7ddf48845a3dbf3b4aaabfc59
MD5 59635213ae912af3fed2509378b40c76
SHA1 9d6619a8b43164b139dd9213e9641bcd14e3bfd5
SHA512 201ce22c0ad1db204008cb3ac31dcc8426aaf0cb6aed24277623a0ec83a5797d3caad8aec428b1bfabf69bfde90019d266928392b31c2e3561a29ece3b5a55f3
TLSH
T19DE0ED4110C816F3C6C72429AE932388DF5B32A81C3CB0A153FA7D2920DBD0E6078286
MD5 SHA1 SHA512 TLSH

Submit Download

memory/116-259-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/224-258-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/452-242-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/564-279-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/628-275-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/632-280-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/640-253-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/720-221-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/752-260-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/840-195-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/872-192-0x0000000000B30000-0x0000000000C26000-memory.dmp

Download

memory/892-219-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/896-255-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/1228-270-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/1272-269-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/1300-252-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/1340-218-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/1532-229-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/1556-257-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/1580-238-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/1648-196-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/1684-204-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/1800-216-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/1896-244-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/1920-228-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/1972-276-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/1996-205-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2056-233-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2064-261-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2076-222-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2112-285-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2180-283-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2204-254-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2268-220-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2312-278-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2336-251-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2380-239-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2428-248-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2452-236-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2508-198-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2544-225-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2556-226-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2640-277-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2796-199-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2800-206-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2864-286-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2912-247-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2960-266-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2968-208-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/2980-212-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/3008-231-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/3128-241-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/3152-274-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/3264-223-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/3328-249-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/3400-200-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/3460-201-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/3532-246-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/3584-282-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/3588-264-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/3684-217-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/3768-215-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/3792-245-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/3796-267-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/3804-230-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/3884-197-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/3908-237-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4036-250-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4080-203-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4120-9-0x00000000010D2000-0x00000000010D3000-memory.dmp

Download

memory/4120-7-0x0000000000FC0000-0x000000000124E000-memory.dmp

Download

memory/4400-256-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4424-210-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4448-262-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4484-271-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4496-281-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4512-263-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4516-209-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4528-227-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4536-273-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4636-240-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4644-224-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4668-194-0x00000000002C8000-0x00000000002C9000-memory.dmp

Download

memory/4668-193-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4692-202-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4704-265-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4732-213-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4760-243-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4788-284-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4796-214-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4876-207-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4908-211-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4912-234-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4972-235-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/4984-232-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

memory/5088-268-0x0000000000240000-0x00000000002DC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads