3b75f616154c97c83c00dba8047d6a47c6babd1b49b2a2ffac535b1c4691c592

Analysis

max time kernel
151s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe
Size 6.8MB
Sample260817-ckenvsha73
SHA256 3b75f616154c97c83c00dba8047d6a47c6babd1b49b2a2ffac535b1c4691c592
MD5 78617efe85e64418b8d4b9307f37441f
SHA1 04b0319c54e7dcab249e11d7167ce8873f9c2118
SHA512 f163ca93e23ab99cf7112979ede4e907d24c3449fc947e08cade02c20ca7b020a45d88c552195d663f12c1480d361c2e299a261ca4d28d0162b1f794c9c9662c
SSDEEP 98304:+gwkQ7iIqMD+IQ9zNBmsOqQgDNcEanicl5:+gwk+vFMRB1igDNTanb
TLSH
T186766D0163A480E9F5B7D1788ABAD635EA717C62073053CF16E0E69B1F376E05E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Program crash 26 IoCs

pid	pid_target	Process
23840	6812	WerFault.exe
47988	7280	WerFault.exe
47880	7044	WerFault.exe
48144	6884	WerFault.exe
51320	13560	WerFault.exe
52612	13328	WerFault.exe
52604	13352	WerFault.exe
52596	13376	WerFault.exe
52588	10400	WerFault.exe
18072	11916	WerFault.exe
46488	75372	WerFault.exe
73216	40764	WerFault.exe
99600	40492	WerFault.exe
103788	40556	WerFault.exe
125876	39916	WerFault.exe
20712	11520	WerFault.exe
48324	51996	WerFault.exe
133812	1296	WerFault.exe
133404	56628	WerFault.exe
134260	29908	WerFault.exe
147132	35432	Process not Found
74788	8792	Process not Found
150412	57512	Process not Found
152360	44268	Process not Found
157564	146724	Process not Found
157116	146972	Process not Found

C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:3004
- C:\USBMonitorSrv.exe
  /i
  2⤵
  PID:408
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:6488
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
  2⤵
  PID:47836

C:\Daemon.exe
"C:\yyzUSB.exe"
1⤵
PID:16992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6812 -s 232
1⤵
- Program crash
PID:23840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7280 -s 244
1⤵
- Program crash
PID:47988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7044 -s 232
1⤵
- Program crash
PID:47880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6884 -s 232
1⤵
- Program crash
PID:48144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13560 -s 232
1⤵
- Program crash
PID:51320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10400 -s 232
1⤵
- Program crash
PID:52588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13376 -s 232
1⤵
- Program crash
PID:52596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13352 -s 232
1⤵
- Program crash
PID:52604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13328 -s 232
1⤵
- Program crash
PID:52612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 7320 -ip 7320
1⤵
PID:57080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 7280 -ip 7280
1⤵
PID:62040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 7272 -ip 7272
1⤵
PID:18100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 7248 -ip 7248
1⤵
PID:19888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 7004 -ip 7004
1⤵
PID:20204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 11916 -s 248
1⤵
- Program crash
PID:18072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1344 -p 9604 -ip 9604
1⤵
PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 12092 -ip 12092
1⤵
PID:21260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1388 -p 12112 -ip 12112
1⤵
PID:21248

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:53280

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:63608

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:5524

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:11608

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:8640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1692 -p 31088 -ip 31088
1⤵
PID:45180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 30900 -ip 30900
1⤵
PID:45208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2060 -p 30872 -ip 30872
1⤵
PID:45224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 40068 -ip 40068
1⤵
PID:45248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2084 -p 40172 -ip 40172
1⤵
PID:45272

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:24112

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:57256

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:55108

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:57292

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:55548

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:11620

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:38160

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:38136

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:43384

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:46376

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:22144

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:67672

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:67680

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:67692

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:67700

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:67708

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:67716

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:67724

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:67732

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:67744

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:67756

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:67772

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:67780

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:67788

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:67796

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:67804

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:67812

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:67828

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:71720

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:71728

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:71736

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:71744

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:71752

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:71760

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:71768

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:71776

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:71784

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:71792

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:71800

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:71808

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:71816

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:71824

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:71832

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:71840

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:71848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 31024 -ip 31024
1⤵
PID:72372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2056 -p 40204 -ip 40204
1⤵
PID:13356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2204 -p 40212 -ip 40212
1⤵
PID:15688

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:52328

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:46412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 30832 -ip 30832
1⤵
PID:17468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2248 -p 30804 -ip 30804
1⤵
PID:21692

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:32592

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:75968

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:75980

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:73528

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:77492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2120 -p 30812 -ip 30812
1⤵
PID:72368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1364 -p 40124 -ip 40124
1⤵
PID:75200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1176 -p 30824 -ip 30824
1⤵
PID:17464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 30752 -ip 30752
1⤵
PID:60004

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:81220

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:81712

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:13396

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:81700

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:77736

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:77724

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:75788

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:82116

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:91044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 75372 -s 308
1⤵
- Program crash
PID:46488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1392 -p 47364 -ip 47364
1⤵
PID:5192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2376 -p 46928 -ip 46928
1⤵
PID:82360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 40764 -s 224
1⤵
- Program crash
PID:73216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2312 -p 46800 -ip 46800
1⤵
PID:73516

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:82296

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:59648

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:59232

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:91500

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:18088

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:85408

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:85984

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:16712

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:90000

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:94136

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:94292

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:94300

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:59668

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:35060

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:92252

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:92256

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:94448

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:94464

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:66052

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:95208

C:\yyzUSB.exe
"C:\yyzUSB.exe"
1⤵
PID:95220

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:98200

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:98212

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:16856

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:16852

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:16884

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:16880

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:16836

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:16832

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:16676

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:91732

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:91712

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:92424

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:73348

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:92476

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:61056

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:96012

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:94956

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:95204

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:94988

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:100444

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:100452

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:100460

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:100468

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:100476

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:100484

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:100492

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:100500

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:100508

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:100516

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:100528

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:100536

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:100544

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:70808

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:70816

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:70824

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:70832

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:70840

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:70848

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:70856

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:70868

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:70876

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:70884

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:70892

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:70900

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:70928

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:70948

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:76732

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:14464

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:91540

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:91548

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:91560

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:91572

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:79808

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:102396

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:98248

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:16868

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:100336

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:97976

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:19444

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:101172

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:66564

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:18548

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:94896

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:60160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 40492 -s 220
1⤵
- Program crash
PID:99600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2264 -p 40436 -ip 40436
1⤵
PID:100768

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:102648

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:102656

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:102664

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:102672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 40556 -s 220
1⤵
- Program crash
PID:103788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1444 -p 45340 -ip 45340
1⤵
PID:103796

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104568

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104580

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104588

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104596

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104604

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104616

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104624

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104632

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104640

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104648

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104656

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104664

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104672

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104680

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104688

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1292 -p 40452 -ip 40452
1⤵
PID:104724

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104740

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104748

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104756

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104820

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104828

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104836

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104848

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104856

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104864

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104872

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104880

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104892

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104916

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104924

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104932

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104940

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104952

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104984

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104992

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:105000

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:105008

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:105016

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:105104

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:103036

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104904

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104912

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:103040

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104960

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104968

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:104976

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:10624

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:20240

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:92212

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:52576

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:48576

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:103140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 40592 -ip 40592
1⤵
PID:106680

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:107080

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:108136

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:108036

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:98872

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:110360

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:110844

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:58432

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:108560

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:113096

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:113268

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:37208

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:110796

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:113232

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:111972

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:113164

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:113108

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:113292

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:113308

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:112044

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:113492

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:113448

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:114596

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:113360

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:98748

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:112388

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:114664

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:111440

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:116488

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:116924

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:101176

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:118800

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:118808

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:118816

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:118828

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:118840

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:119048

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:119056

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:119068

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:119096

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:118760

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:119816

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:119824

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:119832

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:119844

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:119856

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:119864

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:119876

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:119884

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:119896

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:119904

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:119916

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:119992

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:120028

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:120056

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:120064

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:120072

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:120080

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:120088

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:120104

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:120116

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:120136

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:120144

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:120152

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:120164

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:120972

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:120980

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:120988

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:120996

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:121004

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:121016

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:121024

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:121032

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:121040

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:121048

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:121060

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:121068

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:89188

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:121880

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:122444

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:122452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 2540 -p 43952 -ip 43952
1⤵
PID:17068

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:114284

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:122608

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:118524

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:68352

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:119184

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:123020

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:123028

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:123036

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:123044

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:123052

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:123060

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:123796

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:92368

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:124516

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:124524

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:124548

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:124784

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:124508

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:119980

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:124948

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:124956

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:124968

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:124992

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125112

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125784

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125844

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125856

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125868

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 39916 -s 292
1⤵
- Program crash
PID:125876

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125900

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125908

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125916

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125924

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125932

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125940

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125948

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:123872

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125052

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125056

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:124792

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:54828

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:61400

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:21468

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:51652

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:54648

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:55084

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:55024

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:54880

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:52756

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:54832

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:52628

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:48600

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:52056

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:55076

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:52648

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:61988

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:51984

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:61908

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:51176

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:61952

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:51988

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:49356

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:23188

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:62552

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:22176

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:39084

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:43864

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:56092

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125300

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:21860

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125272

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125356

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125416

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125276

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:124964

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125336

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125568

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125032

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125800

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125824

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125344

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125864

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125896

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125516

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125060

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:54848

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:30092

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:62536

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:49592

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:49280

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:62524

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125056

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125876

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:53468

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125212

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:124984

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125240

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:48436

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:51580

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125592

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:125348

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:123920

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:39080

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:51836

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:126420

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:127284

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:30612

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:124452

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128164

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:124804

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128732

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128740

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128748

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:6220

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:6256

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128884

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128892

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128900

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128908

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128912

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128920

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128940

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128944

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:220

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:1480

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:3136

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:3096

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:3912

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:3476

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:640

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:1356

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:1000

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:1172

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:3748

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:4956

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:4052

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:48508

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:90776

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:98512

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:127324

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:68236

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:127276

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128504

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128524

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128540

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128548

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:17724

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:48708

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:48640

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:49052

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:61948

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:55456

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:31924

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:62024

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:62028

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:63504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 11520 -s 228
1⤵
- Program crash
PID:20712

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:9540

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:127380

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:6756

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:101280

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:20684

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:118412

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128048

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:68132

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:64528

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:48632

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:51896

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129032

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129040

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129048

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129056

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129260

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129268

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129284

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129292

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129300

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129308

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129324

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129332

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129344

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129356

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129364

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129376

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129384

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129392

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129404

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129412

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129424

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129432

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129444

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129452

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129460

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129472

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129480

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129560

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129568

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129592

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129600

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129624

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129632

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129640

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129648

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129656

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129664

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129672

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129680

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129692

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129704

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129712

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129728

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129736

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129744

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129756

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129776

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129784

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129792

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129800

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129808

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129816

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129824

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129832

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129844

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129852

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129860

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129868

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:46192

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128072

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:6704

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129488

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129496

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129504

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129440

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128764

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:5832

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:29904

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:47948

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:18852

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:10356

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:48036

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:55204

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:54872

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:99072

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:17392

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:13112

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:51548

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:99400

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129772

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:32128

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:48832

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:9696

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:126424

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:5952

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:51056

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128580

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:5816

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:5900

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128032

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:51720

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130052

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130060

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130068

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130076

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130084

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130092

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130100

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130108

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130116

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130124

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130132

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130140

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130148

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130156

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130168

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129468

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:48300

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129884

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:62632

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128020

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130260

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:18040

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130732

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:54768

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:48720

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:123948

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:131304

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:48104

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:6524

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:8856

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:6544

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:6548

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129224

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130636

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:105448

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:2644

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:2812

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:17184

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130296

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:6572

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130200

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:9704

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:1080

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:4220

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:4796

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:4940

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129580

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129228

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:51736

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129688

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:129220

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:20704

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130196

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130228

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:52984

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:56272

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:9320

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:9340

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:9344

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:9348

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:9352

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:64224

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:9036

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:11708

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130252

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:29964

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:51424

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:20548

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:54752

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130280

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130212

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:9956

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:2364

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:22404

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:57444

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:54996

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:63628

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:61580

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:63616

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:63652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 51996 -s 296
1⤵
- Program crash
PID:48324

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:29992

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:63636

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:48412

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:11496

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:8528

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:128588

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:8568

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:11528

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:8600

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:11628

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:131272

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:76624

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:8876

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:8892

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:90260

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:49040

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:61492

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:12076

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:53996

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:57440

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:12340

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:1372

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:9032

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:11752

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:1760

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:4476

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:51456

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:10372

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:5732

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:5752

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:5768

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:5784

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:131596

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:6020

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:6040

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:6060

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:6264

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:3084

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:132216

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:132224

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:132208

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:130204

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:132856

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:54988

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:132436

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:132920

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:1628

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:131604

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:49560

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:800

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:6412

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:6356

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:132744

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:4000

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:6628

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:48060

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:18828

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:48332

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:6336

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:55588

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:6620

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:8888

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:132208

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:49664

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:131608

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:132924

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:132936

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:132752

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:3940

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:23380

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:132832

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:55408

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:63836

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:132960

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:132952

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:132184

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133128

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133136

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133144

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133152

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133160

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133168

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133176

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133208

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133216

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133220

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133232

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133244

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133252

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133268

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133276

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133284

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133296

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133304

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133316

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133324

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133332

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133344

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133376

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133388

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133416

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133424

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133440

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133460

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133472

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133480

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133492

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133500

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133528

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133536

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133548

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133560

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133568

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133580

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133600

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133624

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133632

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133648

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133656

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133664

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133688

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133696

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133704

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133728

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133744

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133752

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133768

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133776

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133784

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133792

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133800

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133808

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133824

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133816

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133880

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133740

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133860

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133868

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133876

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133888

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133896

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133916

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133840

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133920

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133928

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133948

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133960

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133980

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133996

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134004

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134012

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134024

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134040

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134060

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134064

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134072

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134092

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134108

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134116

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134124

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134132

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134140

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:132724

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133260

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:8956

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133100

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133200

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133344

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133372

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133364

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133592

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:48656

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133612

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133620

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133640

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133644

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:131676

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:4888

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133488

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:55288

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:22336

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133676

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133836

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:23312

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133892

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 57612 -ip 57612
1⤵
PID:133832

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:49368

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 56628 -s 296
1⤵
- Program crash
PID:133404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 300
1⤵
- Program crash
PID:133812

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:56672

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:55600

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133576

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:9692

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134080

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133672

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133708

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:132484

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133984

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:5124

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:12052

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:23236

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133512

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:13016

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:132892

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:52212

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:14112

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133988

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:1556

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133452

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133684

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:1616

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:54520

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:48476

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133680

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133372

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:23268

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134160

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134172

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134180

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134188

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134196

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134204

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134228

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134236

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134244

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 29908 -s 292
1⤵
- Program crash
PID:134260

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134284

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134300

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134316

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134360

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134372

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134392

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134400

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134472

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134488

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134496

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134524

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134532

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134540

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134548

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134560

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134572

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134580

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134604

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134652

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134792

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134824

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134856

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134872

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134880

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:134892

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:3960

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:133032

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:132968

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:137224

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:137232

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:137240

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:137256

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:137264

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:137272

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:137280

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:139548

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:139556

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:139564

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:139572

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:139580

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:139588

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:139596

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:139604

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:139612

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:139620

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:139628

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:139988

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:140180

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:140188

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:140196

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:140204

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:140212

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:140224

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:140232

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:140248

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:140256

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:140264

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:140272

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:140280

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:139396

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:140156

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:140176

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:139040

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:138464

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:139444

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:140556

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:140564

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:140576

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:140584

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:140516

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:141572

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142032

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142040

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142048

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142056

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142068

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142076

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142104

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142112

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142120

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142128

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142136

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142144

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142152

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142160

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142168

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142176

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142184

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142192

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142200

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142208

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142216

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142224

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142260

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:141564

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:141432

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:141664

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:141852

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:141224

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:141960

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:141876

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142328

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142608

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:143140

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:143152

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:143164

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:143172

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:143244

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:143252

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:143260

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:143268

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142944

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142956

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:142604

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:143512

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:143520

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:143532

C:\yyzUSB.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_78617efe85e64418b8d4b9307f37441f_amadey_cobalt-strike_elex_icedid_njrat_remcos_smoke-loader_vidar.exe"
1⤵
PID:143700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Daemon.exe

Path C:\Daemon.exe
Size 454KB
SHA256 484ff8ea8e6ccc3d31671636fd05d0a3ec2642499dda7138f3d8b0b8c753320f
MD5 ec0b7c9826979a5be56d7d4b062d748a
SHA1 5e22683becb46ca2547434b555279c5164bea16e
SHA512 054795373253e418d5434e93f16f327cdb4c092375bbb9c0f0eb4a8a3585c6d359e244db10da60fad60f7934ef1f11b58af0b726d98438383f7ce8f0abd4dd44
SSDEEP 6144:G7JJY5Hebd8Rr6FoYpD6Ws0la8CFt4X8/nClI1ayhmzkq:WJY5HmqRr6FoYpDan8q+86lIEj
TLSH
T191A438016A60C029F3B673F46A6EE168945D7DB04768A4CFE1E57AF986301F26C3325F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.log

Path C:\service.log
Size 427B
SHA256 1bf41536d89282445ece20092a76fad01ac33cc00c70cbc2c6e49980e0cbe88f
MD5 a97b28ccec5fac8fd3e758af07deb2cd
SHA1 6a8629bebece2f54d09621499cfa218c0e51caef
SHA512 4488eaeeb6ba153e4059e8da6cb93039cb71c9e267079d377c8837af2cadc7db102fa7af849ce698919269f9f8b473480505bb2acbed1210aff42f788cc8d19b
TLSH
T160E06D4614C826F3C6C22925AE976399DF5F22281C3CB49583FA3D1921DBD0D6468696
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1124-184-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/2080-107-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/2432-115-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/4332-156-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/15700-332-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/15780-581-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/30228-773-0x0000000000400000-0x000000000049C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads