854a07806d1dd0ef8326d5f548aaaa0f532fc5ea661d2bd07bed6d9f898a717d

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 20:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe
Size 2.1MB
Sample261024-yv9smsff97
SHA256 854a07806d1dd0ef8326d5f548aaaa0f532fc5ea661d2bd07bed6d9f898a717d
MD5 1b214faa6b884e2ae47cbdd6f4de40e2
SHA1 215759ff65a748f2aed093b64e7690ebcb7f9907
SHA512 620c9825f6176f5e5e44640ea38bdf3f0ca7917221098c6552ae786e8479f22b102aab050d6a6a69915cacadb950f7ae7c44921d00a4208ace641aa6f8b45a3b
SSDEEP 24576:qENJKEt6dq8hXj8R2vxW870KHAe5GqR6FokG81Cvz44sLy0aZJQ5Te6LlQhA:qENwzIR257BDIqR6FoRvku04YL
TLSH
T1F5A54A10AB508028FAF752F55AADE16C952C7DF0879860CBB1D576FA86366F02D3334B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4100	USBMonitorSrv.exe
4792	host.exe
4168	Daemon.exe
4576	Daemon.exe
5576	Daemon.exe
3352	Daemon.exe
5564	Daemon.exe
4468	Daemon.exe
4732	Daemon.exe
4356	Daemon.exe
4140	Daemon.exe
2456	Daemon.exe
3676	Daemon.exe
5024	Daemon.exe
4552	Daemon.exe
5296	Daemon.exe
2544	Daemon.exe
2676	Daemon.exe
4748	Daemon.exe
5404	Daemon.exe
3284	Daemon.exe
1276	Daemon.exe
3204	Daemon.exe
2528	Daemon.exe
1152	Daemon.exe
4420	Daemon.exe
3384	Daemon.exe
1228	Daemon.exe
2904	Daemon.exe
2660	Daemon.exe
236	Daemon.exe
5464	Daemon.exe
5052	Daemon.exe
1260	Daemon.exe
2532	Daemon.exe
4712	Daemon.exe
2820	Daemon.exe
3328	Daemon.exe
5324	Daemon.exe
2452	Daemon.exe
3736	Daemon.exe
1344	Daemon.exe
5096	Daemon.exe
260	Daemon.exe
4240	Daemon.exe
1400	Daemon.exe
5160	Daemon.exe
248	Daemon.exe
272	Daemon.exe
3008	Daemon.exe
6128	Daemon.exe
4296	Daemon.exe
4756	Daemon.exe
4632	Daemon.exe
3028	Daemon.exe
5744	Daemon.exe
4188	Daemon.exe
624	Daemon.exe
1912	Daemon.exe
2780	Daemon.exe
5984	Daemon.exe
3940	Daemon.exe
5932	Daemon.exe
1236	Daemon.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\jaccessinspector.log	host.exe
File created	C:\Windows\SysWOW64\copied.exe	yyzUSB.exe
File created	C:\Windows\SysWOW64\host.exe	yyzUSB.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBMonitorSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBMonitorSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yyzUSB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 4100	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	90
PID 3136 wrote to memory of 4792	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	91
PID 3136 wrote to memory of 4168	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	93
PID 3136 wrote to memory of 4576	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	94
PID 3136 wrote to memory of 5576	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	95
PID 3136 wrote to memory of 3352	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	96
PID 3136 wrote to memory of 5564	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	97
PID 3136 wrote to memory of 4468	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	98
PID 3136 wrote to memory of 4732	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	99
PID 3136 wrote to memory of 4356	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	100
PID 3136 wrote to memory of 4140	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	101
PID 3136 wrote to memory of 2456	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	102
PID 3136 wrote to memory of 3676	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	103
PID 3136 wrote to memory of 5024	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	104
PID 3136 wrote to memory of 4552	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	105
PID 3136 wrote to memory of 5296	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	106
PID 3136 wrote to memory of 2676	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	107
PID 3136 wrote to memory of 2544	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	108
PID 3136 wrote to memory of 4748	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	109
PID 3136 wrote to memory of 5404	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	110
PID 3136 wrote to memory of 3284	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	111
PID 3136 wrote to memory of 1276	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	112
PID 3136 wrote to memory of 3204	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	113
PID 3136 wrote to memory of 2528	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	114
PID 3136 wrote to memory of 1152	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	115
PID 3136 wrote to memory of 4420	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	116
PID 3136 wrote to memory of 3384	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	117
PID 3136 wrote to memory of 1228	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	118
PID 3136 wrote to memory of 5060	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	119
PID 3136 wrote to memory of 2904	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	120
PID 3136 wrote to memory of 2660	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	121
PID 3136 wrote to memory of 3292	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	122
PID 3136 wrote to memory of 5464	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	123
PID 3136 wrote to memory of 5052	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	124
PID 3136 wrote to memory of 1260	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	125
PID 3136 wrote to memory of 2532	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	126
PID 3136 wrote to memory of 4712	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	127
PID 3136 wrote to memory of 2820	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	128
PID 3136 wrote to memory of 1344	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	129
PID 3136 wrote to memory of 5324	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	130
PID 3136 wrote to memory of 3736	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	131
PID 3136 wrote to memory of 1400	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	132
PID 3136 wrote to memory of 3328	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	133
PID 3136 wrote to memory of 2452	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	134
PID 3136 wrote to memory of 5096	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	135
PID 3136 wrote to memory of 4240	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	136
PID 3136 wrote to memory of 5160	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	137
PID 3136 wrote to memory of 236	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	138
PID 3136 wrote to memory of 260	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	139
PID 3136 wrote to memory of 248	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	140
PID 3136 wrote to memory of 272	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	141
PID 3136 wrote to memory of 3008	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	142
PID 3136 wrote to memory of 6128	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	143
PID 3136 wrote to memory of 4296	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	144
PID 3136 wrote to memory of 4756	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	145
PID 3136 wrote to memory of 4632	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	146
PID 3136 wrote to memory of 3028	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	147
PID 3136 wrote to memory of 5744	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	148
PID 3136 wrote to memory of 4188	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	149
PID 3136 wrote to memory of 624	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	150
PID 3136 wrote to memory of 1912	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	151
PID 3136 wrote to memory of 2780	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	152
PID 3136 wrote to memory of 5984	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	153
PID 3136 wrote to memory of 3940	3136	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	154

C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3136
- C:\USBMonitorSrv.exe
  /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4100
- C:\Users\Admin\AppData\Local\Temp\host.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4168
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5576
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5564
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5296
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5404
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3292
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5464
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5324
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:260
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:248
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:6128
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5744
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5984
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:5932
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5924
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5020
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4184
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5816
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2232
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:6112
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4600
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3236
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1872
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1160
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5852
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:896
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:972
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4380
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1076
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3876
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1220
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1700
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3344
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:3388
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5944
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2748
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5688
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:920
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4472
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4696
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:780
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2900
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:416
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:4280
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5212
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:2272
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:1652
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:5884
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  PID:404

C:\USBMonitorSrv.exe
C:\USBMonitorSrv.exe
1⤵
- System Location Discovery: System Language Discovery
PID:552
- C:\yyzUSB.exe
  "C:\yyzUSB.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2136
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5904
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5356
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2824
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4344
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5864
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:616
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4640
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4520
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2540
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2608
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2040
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:956
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2680
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6024
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4604
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5136
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6004
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1668
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2884
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5376
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1096
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4676
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:588
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4368
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:816
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5808
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5980
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4776
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4500
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4532
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3088
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1712
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4964
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5592
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1172
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1664
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:900
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3256
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3472
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1952
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2360
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1988
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:564
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5100
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5236
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2304
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4116
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4664
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4332
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1296
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4680
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5724
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1108
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4956
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4880
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4668
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6036
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5856
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5812
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1788
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2016
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5332
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4896
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2888
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5384
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5832
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:5116
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:3400
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:752
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2860
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1184
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2020
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:1200
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6152
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6168
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6176
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6184
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6192
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6200
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6208
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6216
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6224
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6232
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6240
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6248
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6256
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6264
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6272
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6280
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6288
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6296
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6304
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6312
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6320
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6328
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6336
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6344
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6352
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6360
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6368
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6376
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6384
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6392
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6400
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6408
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6416
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6424
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6432
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6440
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6448
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6456
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6464
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6472
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6480
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6488
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6496
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6504
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6512
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6520
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6528
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6536
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6544
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6552
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6560
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6568
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6576
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6584
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6592
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6600
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6608
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6616
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6624
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6632
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6640
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6648
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6656
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6664
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6672
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6680
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6688
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6696
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6704
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6712
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6720
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6728
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6736
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6744
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6752
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6760
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6768
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6776
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6784
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6792
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6800
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6808
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6816
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6824
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6832
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6840
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6848
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6856
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6864
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6872
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6880
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6888
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6896
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6904
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6912
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6920
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6928
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6936
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6944
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6952
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6960
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6968
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6976
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6984
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:6992
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7000
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7008
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7016
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7024
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7032
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7040
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7048
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7056
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7064
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7072
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7080
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7088
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7096
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7104
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7112
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7120
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7128
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7136
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7144
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7152
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7160
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7172
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7180
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7188
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7196
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7204
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7212
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7220
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7228
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7236
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7244
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7252
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7260
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7268
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7276
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7284
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7292
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7300
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7308
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7316
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7324
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7332
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7340
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7348
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7356
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7364
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7372
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7380
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7388
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7396
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7404
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7412
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7420
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7428
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7436
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7444
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7452
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7460
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7468
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7476
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7484
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7492
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7500
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7508
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7516
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7524
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7532
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7540
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7548
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7556
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7564
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7572
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7580
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7588
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7596
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7604
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7612
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7620
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7628
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7636
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7644
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7652
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7660
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7668
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7676
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7684
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7692
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7700
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7708
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7716
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7724
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7732
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7740
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7748
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7756
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7764
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7772
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7780
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7788
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7796
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7804
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7812
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7820
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7828
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7836
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7844
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7852
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7860
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7868
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7876
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7884
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7892
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7900
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7908
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7916
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7924
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7932
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7940
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7948
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7956
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7964
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7972
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7980
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7988
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:7996
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8004
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8012
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8020
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8028
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8036
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8044
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8052
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8060
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8068
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8076
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8084
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8092
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8100
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8108
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8116
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8124
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8132
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8140
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8148
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8156
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8164
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8172
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8180
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8188
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8200
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8208
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8216
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8224
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8232
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8240
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8248
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8256
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8264
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8272
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8280
- - C:\Windows\SysWOW64\host.exe
    "C:\yyzUSB.exe"
    3⤵
    - Drops file in System32 directory
    PID:8288
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8300
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8308
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8316
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8324
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8332
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8340
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8348
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8356
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8364
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8372
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8380
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8388
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8396
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8404
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8412
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8420
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8428
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8436
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8444
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8452
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8460
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8468
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8476
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8484
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8492
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8500
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8508
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8516
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8524
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8532
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8540
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8548
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8556
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8564
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8572
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8580
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8588
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8596
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8604
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8612
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8620
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8628
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8636
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8644
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8652
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8660
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8668
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8676
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8684
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8692
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8700
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8708
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8716
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8724
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8732
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8740
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8748
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8756
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8764
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8772
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8780
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8788
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8796
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8804
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8812
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8820
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8828
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8836
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8844
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8852
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8860
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8868
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8876
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8884
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8892
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8900
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8908
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8916
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8924
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8932
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8940
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8948
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8956
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8964
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8972
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8980
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8988
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:8996
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9008
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9016
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9028
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9036
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9044
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9052
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9060
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9068
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9076
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9084
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9092
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9100
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9108
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9116
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9124
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9132
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9140
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9148
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9156
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9164
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9172
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9180
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9188
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9196
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9204
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9212
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:2164
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:4900
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9220
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9228
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9236
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9244
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9252
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9260
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9268
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9276
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9284
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9292
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9300
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9308
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9316
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9324
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9332
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9340
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9348
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9356
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9364
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9372
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9380
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9388
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9396
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9404
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9412
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9420
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9428
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9436
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9444
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9452
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9460
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9468
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9476
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9484
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9492
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9500
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9508
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9516
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9524
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9532
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9540
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9548
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9556
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9564
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9572
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9580
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9588
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9596
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9604
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9612
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9620
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9628
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9636
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9644
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9652
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9660
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9668
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9676
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9684
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9692
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9700
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9708
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9716
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9724
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9732
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9740
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9748
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9756
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9764
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9772
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9780
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9788
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9796
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9804
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:9812
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    PID:10192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Daemon.exe

Path C:\Daemon.exe
Size 454KB
SHA256 1d4a9e19b470570cf52676d3cad4dfb8880e7fba83df9a034792677c2f4c8e32
MD5 6175b5dc639ebb11fc708a67b4e7a3e3
SHA1 d8f5a80e548ec700cfa0b85293ea15e8b4141e8c
SHA512 8653c2fd4107cf636fca88446ce6bdc3262ad61376eb464096e2d1bf48d2b807c4e09c98fcd5a070f296d0e1314f8d8b3e439ec70697d3198a5f962e750b4007
SSDEEP 6144:G7JJY5Hebd8Rr6FoYpD6Ws0la8CFt4X8/nClI1wyhmz1q:WJY5HmqRr6FoYpDan8q+86lIyI
TLSH
T1D2A438016A60C029F3B673F46A6EE168945D7DB04768A4CFE1E57AF986301F26C3325F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

USBMonitorSrv.exe

Path C:\USBMonitorSrv.exe
Size 694KB
SHA256 f92c2d3b3f1df60b6401f697a05bd3e200a824a9aa2cc84a021963c911987c20
MD5 9ac3dc0ce15644d39b039527d942685c
SHA1 a08e14954fd47f58eeec36e9942a12557066c7d1
SHA512 360d31a9e66802a18610c8688be17c3bbf762db62c0f36a1b20477d42648bacbd8a0d50a54d05f1745fbb576c87878716242bdc2e7b81dff276e592d37182522
SSDEEP 12288:GHtTeTvIchy4LoLtlG8ZtwJ0ofJ2/5v7nL9Hwn6Lz:gCvz44sLy0aZJQ5Te6L
TLSH
T10FE45A10BB518429FDF751F54AFEA17C952C79B0DB9C20CB60C953EA463A6F02E36287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host.exe

Path C:\Users\Admin\AppData\Local\Temp\host.exe
Size 103KB
SHA256 792b89cbd462e51406849e6927737f60e5fbd6b2390f7d07237387a9c9c2b510
MD5 5b72c9c60282f6a7b6e5332188943b1f
SHA1 a6004276c40e5d68c5ded16cb9816154be87731a
SHA512 1298978c39a4df42101f62c47b064a37003d72266ce808b3fc7a58c76c3c634e476db744a0c10d5bc382908bf32189440ec0719ca400b5709efbba60d1e79c60
SSDEEP 3072:YvaBU1Lhceff4Sx7nrl/RZZOH7rFxAXX4J1WXoTa00liUNLIcUaZ4aE68Mezni9t:e4U1Lhceff4Sx7nrl/RZZOH7rFxAXX4m
TLSH
T18EA3B34BAB9450D5D8F6C0B894E1A61AEA3131E98330E7DFA794440F4F62BD0BD3DB49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.log

Path C:\service.log
Size 431B
SHA256 79572d930d1516a2ecc468e58eefee605b7e9f578787cf7df587598e4dd04f40
MD5 5077ea918e543972aa7c981eaaf49c7b
SHA1 8efef7d8567894cd6b46050c051104e158abe706
SHA512 fbd741d6e3c26ce6232ba6f1eeb4c0846129cd3919e6599258ec5566f43da498e90eef350546227cc7c7f63600f6b4db55f2ef2ced1099b0464be316ad7a1992
TLSH
T1E8E0ED4110C812F3C6C22429AE932388DF5B32281C3CB49183FA3D2930DBD0D60A8696
MD5 SHA1 SHA512 TLSH

Submit Download

memory/236-111-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/248-155-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/260-121-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/272-157-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/404-176-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/624-164-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/780-178-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/896-132-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/972-133-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/1076-134-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/1152-105-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/1160-130-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/1220-142-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/1228-108-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/1236-172-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/1260-113-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/1276-95-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/1344-122-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/1400-153-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/1652-177-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/1700-135-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/1912-166-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/2232-127-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/2452-152-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/2456-140-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/2528-97-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/2532-114-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/2544-90-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/2660-110-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/2676-91-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/2748-138-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/2780-167-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/2820-116-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/2904-109-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/3008-158-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/3028-163-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/3136-1-0x0000000000602000-0x0000000000603000-memory.dmp

Download

memory/3136-0-0x00000000004F0000-0x0000000000752000-memory.dmp

Download

memory/3204-96-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/3236-129-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/3284-94-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/3292-145-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/3328-126-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/3344-136-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/3352-99-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/3384-107-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/3388-125-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/3676-118-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/3736-123-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/3876-179-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/3940-169-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4100-11-0x0000000000CA0000-0x0000000000D96000-memory.dmp

Download

memory/4140-149-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4168-32-0x0000000000588000-0x0000000000589000-memory.dmp

Download

memory/4168-31-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4184-174-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4188-165-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4240-151-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4296-160-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4356-103-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4380-124-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4420-106-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4468-102-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4472-144-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4552-88-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4576-33-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4576-119-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4600-128-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4632-161-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4696-147-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4712-115-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4732-104-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4748-92-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/4756-162-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5020-170-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5024-150-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5052-112-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5096-154-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5160-156-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5212-180-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5296-89-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5324-117-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5404-93-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5464-101-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5564-100-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5576-98-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5688-139-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5744-146-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5816-175-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5852-131-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5924-173-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5932-171-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5944-137-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/5984-168-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/6112-141-0x0000000000500000-0x000000000059C000-memory.dmp

Download

memory/6128-159-0x0000000000500000-0x000000000059C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads