1064bd173f7498c8cbb1c4a2c5211af1404cbca311001a7153cb18cd4c291e31

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe
Size 2.2MB
Sample261024-na9xsshv2y
SHA256 1064bd173f7498c8cbb1c4a2c5211af1404cbca311001a7153cb18cd4c291e31
MD5 61cf7ac470e407820efd61f7b86cf6a3
SHA1 c5c9712675582d48582f13d563b054eceea57818
SHA512 3d6a6a7f0726dd6ca88e1d075063b888b3f7980cc6c4c55db530418346fa5a6400bf1be8e9526ea98863656f2a40561909acffcef25ff7d30a99465fcfadc54f
SSDEEP 24576:VENJKEt6dq8hXj8R2vxW870KH/e5GqR6FokG81Cvz44sLy0aZJQ5Te6LnJIU3:VENwzIR257BWIqR6FoRvku04YLnJIU
TLSH
T1DDB56C21BB108464FAF752F55AEDE16896197CB08B9860CBB0D573FE4A366F02D33247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2612	USBMonitorSrv.exe
2228	host.exe
4324	Daemon.exe
4444	Daemon.exe
4088	Daemon.exe
2408	Daemon.exe
5104	Daemon.exe
3476	Daemon.exe
1092	Daemon.exe
4952	Daemon.exe
2704	Daemon.exe
2136	Daemon.exe
2880	Daemon.exe
2180	Daemon.exe
2684	Daemon.exe
4796	Daemon.exe
5820	Daemon.exe
1688	Daemon.exe
5724	Daemon.exe
5748	Daemon.exe
1628	Daemon.exe
1492	Daemon.exe
2708	Daemon.exe
4584	Daemon.exe
4696	Daemon.exe
424	Daemon.exe
4424	Daemon.exe
4676	Daemon.exe
3864	Daemon.exe
4168	Daemon.exe
1100	Daemon.exe
204	Daemon.exe
248	Daemon.exe
6044	Daemon.exe
5904	Daemon.exe
1464	Daemon.exe
6092	Daemon.exe
416	Daemon.exe
5712	Daemon.exe
3396	Daemon.exe
2632	Daemon.exe
5500	Daemon.exe
5992	Daemon.exe
1120	Daemon.exe
5896	Daemon.exe
4964	Daemon.exe
6080	Daemon.exe
5572	Daemon.exe
1568	Daemon.exe
5740	Daemon.exe
5528	Daemon.exe
5624	Daemon.exe
2196	Daemon.exe
2236	Daemon.exe
3060	Daemon.exe
3416	Daemon.exe
2660	Daemon.exe
4712	Daemon.exe
4064	Daemon.exe
3120	Daemon.exe
4356	Daemon.exe
2848	Daemon.exe
5532	Daemon.exe
4744	Daemon.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\copied.exe	yyzUSB.exe
File created	C:\Windows\SysWOW64\host.exe	yyzUSB.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBMonitorSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBMonitorSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yyzUSB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 2612	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	90
PID 3688 wrote to memory of 2228	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	91
PID 3688 wrote to memory of 4324	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	93
PID 3688 wrote to memory of 4444	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	94
PID 3688 wrote to memory of 4088	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	95
PID 3688 wrote to memory of 2408	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	96
PID 3688 wrote to memory of 5104	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	97
PID 3688 wrote to memory of 3476	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	98
PID 3688 wrote to memory of 1092	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	99
PID 3688 wrote to memory of 4952	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	100
PID 3688 wrote to memory of 2704	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	101
PID 3688 wrote to memory of 2136	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	102
PID 3688 wrote to memory of 2880	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	103
PID 3688 wrote to memory of 2180	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	104
PID 3688 wrote to memory of 2684	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	105
PID 3688 wrote to memory of 4796	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	106
PID 3688 wrote to memory of 5820	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	107
PID 3688 wrote to memory of 1688	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	108
PID 3688 wrote to memory of 5724	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	109
PID 3688 wrote to memory of 5748	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	110
PID 3688 wrote to memory of 1628	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	111
PID 3688 wrote to memory of 1492	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	112
PID 3688 wrote to memory of 2708	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	113
PID 3688 wrote to memory of 4584	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	114
PID 3688 wrote to memory of 4696	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	115
PID 3688 wrote to memory of 424	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	116
PID 3688 wrote to memory of 4424	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	117
PID 3688 wrote to memory of 4676	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	118
PID 3688 wrote to memory of 3864	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	119
PID 3688 wrote to memory of 4168	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	120
PID 3688 wrote to memory of 1100	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	121
PID 3688 wrote to memory of 204	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	122
PID 3688 wrote to memory of 248	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	123
PID 3688 wrote to memory of 6044	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	124
PID 3688 wrote to memory of 5904	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	125
PID 3688 wrote to memory of 1464	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	126
PID 3688 wrote to memory of 6092	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	127
PID 3688 wrote to memory of 416	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	128
PID 3688 wrote to memory of 5712	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	129
PID 3688 wrote to memory of 3396	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	130
PID 3688 wrote to memory of 2632	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	131
PID 3688 wrote to memory of 5500	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	132
PID 3688 wrote to memory of 5992	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	133
PID 3688 wrote to memory of 1120	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	134
PID 3688 wrote to memory of 5896	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	135
PID 3688 wrote to memory of 4964	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	136
PID 3688 wrote to memory of 6080	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	137
PID 3688 wrote to memory of 5572	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	138
PID 3688 wrote to memory of 1568	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	139
PID 3688 wrote to memory of 5740	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	140
PID 3688 wrote to memory of 5528	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	141
PID 3688 wrote to memory of 5624	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	142
PID 3688 wrote to memory of 2196	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	143
PID 3688 wrote to memory of 2236	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	144
PID 3688 wrote to memory of 3060	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	145
PID 3688 wrote to memory of 3416	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	146
PID 3688 wrote to memory of 2660	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	147
PID 3688 wrote to memory of 4712	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	148
PID 3688 wrote to memory of 4064	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	149
PID 3688 wrote to memory of 3120	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	150
PID 3688 wrote to memory of 4356	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	151
PID 3688 wrote to memory of 2848	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	152
PID 3688 wrote to memory of 5532	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	153
PID 3688 wrote to memory of 4744	3688	2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe	154

C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3688
- C:\USBMonitorSrv.exe
  /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2612
- C:\Users\Admin\AppData\Local\Temp\host.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4324
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5820
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5724
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5748
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:424
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:204
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:248
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:6044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5904
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:6092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:416
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5500
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5992
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:6080
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5740
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5528
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5532
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1388
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3464
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4840
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3824
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1412
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1044
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2980
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4948
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5392
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2604
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4572
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:6100
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5564
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4116
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5308
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3644
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4084
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:788
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4240
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:812
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4292
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4192
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2944
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3172
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4216
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4644
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3520
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1336
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3540
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3708
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2976
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2728
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2480
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1428
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1404
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5396
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2820
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4308
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2540
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4132
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2064
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5996
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5836
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3564
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2616
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4152
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:2508
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3428
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:1712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:4264
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5024
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5420
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3208
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5372
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5884
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:5400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:3632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_61cf7ac470e407820efd61f7b86cf6a3_amadey_elex_glassworm_remcos_smoke-loader.exe"
  2⤵
  PID:720

C:\USBMonitorSrv.exe
C:\USBMonitorSrv.exe
1⤵
- System Location Discovery: System Language Discovery
PID:7152
- C:\yyzUSB.exe
  "C:\yyzUSB.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2352
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4516
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5776
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1680
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3444
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3908
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1828
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3880
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4384
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3344
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3488
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5976
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3000
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2552
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3592
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2596
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4472
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4512
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5964
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4528
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6176
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:256
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5696
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4980
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6196
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6208
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6224
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3420
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6240
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5368
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6260
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1652
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1880
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2648
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6288
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6300
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5404
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6308
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5312
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6332
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1072
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4204
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1192
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2856
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5344
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4176
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5536
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2056
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3288
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2520
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3012
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2440
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2940
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3744
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:984
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4684
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:556
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4972
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6108
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:908
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:716
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2776
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2996
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6388
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6416
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2812
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4276
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3652
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3820
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3376
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4108
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4112
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3460
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4340
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6004
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4344
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4184
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6020
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3740
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6172
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6276
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6292
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6420
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1472
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2420
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3076
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5236
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2816
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6116
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5348
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2240
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6136
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2908
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3440
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5364
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3876
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4432
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1032
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4792
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5256
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1084
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4976
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6888
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3212
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6104
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6032
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2924
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:916
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2272
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:572
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3552
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4604
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6352
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6336
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6316
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6304
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6268
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6252
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6236
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6216
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6200
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6180
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6148
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3028
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4212
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6880
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3284
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1996
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7036
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7128
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6816
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6548
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7136
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6828
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6560
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6716
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6444
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7032
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6724
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6728
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6456
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7044
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6736
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6468
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7056
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7060
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6476
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7064
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6752
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6484
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7072
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6756
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6488
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7080
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6768
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6500
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7088
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6776
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6508
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7096
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6784
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6516
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7104
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6792
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6524
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7112
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6804
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6536
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7120
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6808
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6540
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3360
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2456
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6824
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6556
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5268
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:120
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5548
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4220
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1580
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3424
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3348
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7176
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7184
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7192
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7200
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7208
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7216
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7224
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7232
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7240
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7248
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7256
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7264
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7272
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7280
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7288
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7296
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7304
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7312
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7320
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7328
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7336
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7344
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7352
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7360
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7368
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7376
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7384
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7392
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7400
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7408
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7416
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7424
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7432
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7440
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7448
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7456
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7464
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7472
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7480
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7488
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7496
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7504
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7512
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7520
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7528
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7536
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7544
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7552
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7560
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7568
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7576
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7584
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7592
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7600
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7608
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7616
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7624
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7632
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7640
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7648
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7656
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7664
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7672
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7680
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7688
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7696
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7704
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7712
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7720
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7728
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7736
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7744
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7752
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7760
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7768
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7776
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7784
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7792
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7800
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7808
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7816
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7824
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7832
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7840
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7848
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7856
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7864
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7872
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7880
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7888
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7896
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7904
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7912
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7920
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7928
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7936
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7944
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7952
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7960
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7968
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7976
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7984
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7992
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8000
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8008
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8016
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8024
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8032
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8040
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8048
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8056
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8064
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8072
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8080
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8088
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8096
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8104
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8112
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8120
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8128
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8136
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8144
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8152
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8168
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8176
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8184
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8196
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8204
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8212
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8220
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8228
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8236
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8244
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8252
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8260
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8268
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8276
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8284
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8292
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8300
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8308
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8316
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8324
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8332
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8340
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8348
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8356
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8364
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8372
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8380
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8388
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8396
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8404
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8412
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8420
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8428
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8436
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8444
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8452
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8460
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8468
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8476
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8484
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8492
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8500
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8508
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8516
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8524
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8532
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8540
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8548
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8556
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8564
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8572
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8580
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8588
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8596
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8604
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8612
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8620
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8628
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8636
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8644
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8652
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8660
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8668
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8676
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8684
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8692
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8700
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8708
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8716
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8724
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8732
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8740
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8748
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8756
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8764
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8772
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8780
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8788
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8796
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8804
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8812
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8820
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8828
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8836
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8844
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8852
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8860
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8868
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8876
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8884
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8892
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8900
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8908
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8916
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8924
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8932
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8940
- - C:\Windows\SysWOW64\host.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8948
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9040
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9052
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9060
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9068
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9076
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9084
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9092
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9100
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9108
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9116
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9124
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9132
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9140
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9148
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9156
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9164
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9172
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9180
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9188
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9196
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9204
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9212
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4312
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6000
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3140
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1976
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5088
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9244
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9260
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9272
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9288
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9300
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Daemon.exe

Path C:\Daemon.exe
Size 454KB
SHA256 1d4a9e19b470570cf52676d3cad4dfb8880e7fba83df9a034792677c2f4c8e32
MD5 6175b5dc639ebb11fc708a67b4e7a3e3
SHA1 d8f5a80e548ec700cfa0b85293ea15e8b4141e8c
SHA512 8653c2fd4107cf636fca88446ce6bdc3262ad61376eb464096e2d1bf48d2b807c4e09c98fcd5a070f296d0e1314f8d8b3e439ec70697d3198a5f962e750b4007
SSDEEP 6144:G7JJY5Hebd8Rr6FoYpD6Ws0la8CFt4X8/nClI1wyhmz1q:WJY5HmqRr6FoYpDan8q+86lIyI
TLSH
T1D2A438016A60C029F3B673F46A6EE168945D7DB04768A4CFE1E57AF986301F26C3325F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

USBMonitorSrv.exe

Path C:\USBMonitorSrv.exe
Size 694KB
SHA256 f92c2d3b3f1df60b6401f697a05bd3e200a824a9aa2cc84a021963c911987c20
MD5 9ac3dc0ce15644d39b039527d942685c
SHA1 a08e14954fd47f58eeec36e9942a12557066c7d1
SHA512 360d31a9e66802a18610c8688be17c3bbf762db62c0f36a1b20477d42648bacbd8a0d50a54d05f1745fbb576c87878716242bdc2e7b81dff276e592d37182522
SSDEEP 12288:GHtTeTvIchy4LoLtlG8ZtwJ0ofJ2/5v7nL9Hwn6Lz:gCvz44sLy0aZJQ5Te6L
TLSH
T10FE45A10BB518429FDF751F54AFEA17C952C79B0DB9C20CB60C953EA463A6F02E36287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host.exe

Path C:\Users\Admin\AppData\Local\Temp\host.exe
Size 281KB
SHA256 6d54694077faf07473196da7b7f1c6981c8ad6a462fcea4777a80cfc6bc5769e
MD5 3dc3594fb3b25c55081fe4b3226abbc2
SHA1 7eaddfd597fc76244f71f98877f7149c9e85dc9e
SHA512 8f268673c86e2c38d1713696ed25b75a565d8beb5b05ea755c9cbb12f625b8d4abfc1bb3f9f54c297ba4bd7dd9e465737c30f492aaef0034b0e1568ce13d2445
SSDEEP 6144:zOOr/BJ/GKWWBNU6ITLBi0qttclOKgU91Bg:meBNUbTVO86Uq
TLSH
T11254E73BEE28FCD2C27A8DB85A918640E77274704B61A3CBD175830EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.log

Path C:\service.log
Size 433B
SHA256 1f5bcd0a83ca9b8d023e829035a63240bcc1722e86277f8ed74102063e34393a
MD5 a47163f31d6a91e8ea622c135b0bca03
SHA1 5157d46306a8469751694d1bca42a4d1349bafca
SHA512 6c2d90ab6195a3d3aedd111eb45fc610780a7b70234cf488ddcac0ecb18cd062ec9d29ced3d5058741425943a63151f2fa819d80b6f263ee209219a6c188532e
TLSH
T11CE0ED8110C812F3C6C72429AE932388DF5B32A81C3DB0A153FA7D2920DBD0E6078286
MD5 SHA1 SHA512 TLSH

Submit Download

memory/204-249-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/248-250-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/416-255-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/788-282-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/812-323-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/1044-281-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/1092-261-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/1100-248-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/1120-274-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/1336-310-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/1388-298-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/1412-301-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/1464-253-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/1492-305-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/1568-286-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/1628-331-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/1688-327-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/2136-264-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/2180-266-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/2196-293-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/2236-294-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/2408-258-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/2452-322-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/2604-315-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/2612-10-0x0000000000DF0000-0x0000000000EE6000-memory.dmp

Download

memory/2632-270-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/2660-256-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/2684-242-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/2704-263-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/2708-307-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/2848-292-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/2880-265-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/2932-299-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/2944-325-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/2976-333-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/2980-302-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/3060-295-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/3120-279-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/3172-289-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/3396-268-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/3464-285-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/3476-329-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/3520-313-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/3644-320-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/3688-3-0x0000000000542000-0x0000000000543000-memory.dmp

Download

memory/3688-1-0x0000000000430000-0x00000000006BE000-memory.dmp

Download

memory/3824-277-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/3864-246-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4064-275-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4084-321-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4088-259-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4116-319-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4168-247-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4192-312-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4216-326-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4240-303-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4292-324-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4324-146-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4324-244-0x0000000000408000-0x0000000000409000-memory.dmp

Download

memory/4356-284-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4424-330-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4444-257-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4572-316-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4584-311-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4644-334-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4676-245-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4696-308-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4712-296-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4744-273-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4796-243-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4840-287-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4948-314-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4952-262-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/4964-278-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/5104-260-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/5392-332-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/5420-306-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/5500-271-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/5528-290-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/5532-297-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/5564-318-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/5572-283-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/5624-291-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/5712-267-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/5724-328-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/5740-288-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/5748-304-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/5820-309-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/5824-300-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/5896-276-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/5904-252-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/5992-272-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/6044-251-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/6080-280-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/6092-254-0x0000000000380000-0x000000000041C000-memory.dmp

Download

memory/6100-317-0x0000000000380000-0x000000000041C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads