demon

Demon is Havoc's default C/ASM agent used to maintain a command-and-control session with a Havoc Teamserver. The documented agent supports check-ins, process enumeration, file transfer, command execution, token operations, and configurable injection and sleep features. It is not a standalone demon.exe CLI: operator commands are issued through a connected Havoc Client session. Current upstream documentation does not substantiate the listed LSASS/SAM/WDigest flags; the command reference is incomplete and deployments may add custom modules.