Analysis
- max time kernel
92s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/05/2026, 04:34
Behavioral task
behavioral1
Sample
2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
General
- Target 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
- Size 1.8MB
- Sample260510-e63c6abx9r
- SHA256 23740d1c78e581550ec0f3d5d2583403b9fa91782fb7bb156ffd804b0d0fdcd2
- MD5 2b1fb3716206fa2dd02b890a8b5d3d84
- SHA1 d7967c8ca5b2cfde40fb5a82b90c23c843df24b8
- SHA512 bb1db482dbc9478f4ac9f7a5c11bbbf19b6d40149a9d6e0a616b21cc2089a94219fb3491edc76004a2f08a096ac3c9d7d04395b84b51021bec2d6484d9b725b7
- SSDEEP 49152:XxPPtjtQiIhUyQy1SkFMxPPtjtQiIhUyQy1SkFA:pINQy1S7INQy1Sn
- TLSH T12F95BE23B5828032D46250B0526D6B76AEBDBC39073159DB57C80E656F34AC1BF39F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral1/files/0x000c0000000242d5-2.dat family_shodi behavioral1/files/0x000700000002455b-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 3540 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4488 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4516 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4948 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3408 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5976 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5340 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2068 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3484 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2272 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3016 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3928 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2532 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2628 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2644 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2580 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5932 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5180 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5084 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4420 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2968 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1724 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2296 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3692 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 6092 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1864 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4416 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 6132 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3744 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5044 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5172 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4908 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4440 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3604 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4972 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4120 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3880 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 648 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3148 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 6072 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5708 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 980 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4920 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2548 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5864 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4628 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4104 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1804 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 6076 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5520 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5868 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4644 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5016 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1968 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1160 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1868 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5800 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2756 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2936 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2588 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4592 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 6140 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5680 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3300 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\uninstall\helper.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaws.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\VideoLAN\VLC\vlc.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msotd.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\firefox.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\VPREVIEW.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\crashreporter.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\Wordconv.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\updater.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\WORDICON.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOUC.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSQRY32.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1952 wrote to memory of 3540 1952 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe 85 PID 3540 wrote to memory of 4488 3540 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 86 PID 4488 wrote to memory of 4516 4488 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 87 PID 4516 wrote to memory of 4948 4516 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 88 PID 4948 wrote to memory of 3408 4948 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 89 PID 3408 wrote to memory of 5976 3408 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 90 PID 5976 wrote to memory of 5340 5976 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 91 PID 5340 wrote to memory of 2068 5340 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 92 PID 2068 wrote to memory of 3484 2068 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 93 PID 3484 wrote to memory of 2272 3484 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 94 PID 2272 wrote to memory of 3016 2272 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 95 PID 3016 wrote to memory of 3928 3016 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 96 PID 3928 wrote to memory of 2532 3928 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 97 PID 2532 wrote to memory of 2628 2532 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 98 PID 2628 wrote to memory of 2644 2628 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 99 PID 2644 wrote to memory of 2580 2644 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 100 PID 2580 wrote to memory of 5932 2580 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 101 PID 5932 wrote to memory of 5180 5932 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 102 PID 5180 wrote to memory of 5084 5180 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 103 PID 5084 wrote to memory of 4420 5084 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 104 PID 4420 wrote to memory of 2968 4420 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 105 PID 2968 wrote to memory of 1724 2968 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 106 PID 1724 wrote to memory of 2296 1724 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 107 PID 2296 wrote to memory of 3692 2296 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 108 PID 3692 wrote to memory of 6092 3692 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 109 PID 6092 wrote to memory of 1864 6092 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 110 PID 1864 wrote to memory of 4416 1864 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 111 PID 4416 wrote to memory of 6132 4416 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 112 PID 6132 wrote to memory of 3744 6132 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 113 PID 3744 wrote to memory of 5044 3744 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 114 PID 5044 wrote to memory of 5172 5044 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 115 PID 5172 wrote to memory of 4908 5172 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 116 PID 4908 wrote to memory of 4440 4908 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 117 PID 4440 wrote to memory of 3604 4440 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 118 PID 3604 wrote to memory of 4972 3604 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 119 PID 4972 wrote to memory of 4120 4972 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 120 PID 4120 wrote to memory of 3880 4120 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 121 PID 3880 wrote to memory of 648 3880 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 122 PID 648 wrote to memory of 3148 648 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 123 PID 3148 wrote to memory of 6072 3148 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 124 PID 6072 wrote to memory of 5708 6072 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 125 PID 5708 wrote to memory of 980 5708 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 126 PID 980 wrote to memory of 4920 980 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 127 PID 4920 wrote to memory of 2548 4920 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 128 PID 2548 wrote to memory of 5864 2548 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 129 PID 5864 wrote to memory of 4628 5864 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 130 PID 4628 wrote to memory of 4104 4628 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 131 PID 4104 wrote to memory of 1804 4104 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 132 PID 1804 wrote to memory of 6076 1804 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 133 PID 6076 wrote to memory of 5520 6076 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 134 PID 5520 wrote to memory of 5868 5520 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 135 PID 5868 wrote to memory of 4644 5868 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 136 PID 4644 wrote to memory of 5016 4644 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 137 PID 5016 wrote to memory of 1968 5016 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 138 PID 1968 wrote to memory of 1160 1968 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 139 PID 1160 wrote to memory of 1868 1160 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 140 PID 1868 wrote to memory of 5800 1868 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 141 PID 5800 wrote to memory of 2756 5800 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 142 PID 2756 wrote to memory of 2936 2756 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 143 PID 2936 wrote to memory of 2588 2936 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 144 PID 2588 wrote to memory of 4592 2588 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 145 PID 4592 wrote to memory of 6140 4592 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 146 PID 6140 wrote to memory of 5680 6140 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 147 PID 5680 wrote to memory of 3300 5680 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa65⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa66⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa67⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa68⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa69⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa70⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa71⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa72⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa73⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa74⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa75⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa76⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa77⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa78⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa79⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa80⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa81⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa82⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa83⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa84⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa85⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa86⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa87⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa88⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa89⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa90⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa91⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa92⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa93⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa94⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa95⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa96⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa97⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa98⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa99⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa100⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa101⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa102⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa103⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa104⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa105⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa106⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa107⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa108⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa109⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa110⤵
- System Location Discovery: System Language Discovery
PID:100 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa111⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa112⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa113⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa114⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa115⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa116⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa117⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa118⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa119⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa120⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa121⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa122⤵PID:2088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-