Analysis
- max time kernel
96s - max time network
92s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
10/05/2026, 04:34
Behavioral task
behavioral1
Sample
2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
General
- Target 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
- Size 1.8MB
- Sample260510-e63c6abx9r
- SHA256 23740d1c78e581550ec0f3d5d2583403b9fa91782fb7bb156ffd804b0d0fdcd2
- MD5 2b1fb3716206fa2dd02b890a8b5d3d84
- SHA1 d7967c8ca5b2cfde40fb5a82b90c23c843df24b8
- SHA512 bb1db482dbc9478f4ac9f7a5c11bbbf19b6d40149a9d6e0a616b21cc2089a94219fb3491edc76004a2f08a096ac3c9d7d04395b84b51021bec2d6484d9b725b7
- SSDEEP 49152:XxPPtjtQiIhUyQy1SkFMxPPtjtQiIhUyQy1SkFA:pINQy1S7INQy1Sn
- TLSH T12F95BE23B5828032D46250B0526D6B76AEBDBC39073159DB57C80E656F34AC1BF39F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000f000000025aaf-2.dat family_shodi behavioral2/files/0x001a00000002b3d7-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 1192 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2872 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3696 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1824 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3908 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3032 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2864 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4744 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3864 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1408 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2428 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3788 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2116 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4056 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4288 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1892 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1172 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5036 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4528 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2484 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3960 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4128 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5060 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2256 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4948 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2976 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3720 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1916 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2156 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 996 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3940 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2264 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2712 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5052 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 560 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3948 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1012 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4192 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2688 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1092 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1468 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4828 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1756 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3204 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2200 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3292 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2916 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3472 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1416 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1452 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3980 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5112 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3784 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3068 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1744 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2564 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1620 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 340 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3568 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1676 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3692 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1472 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 944 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2700 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Mozilla Firefox\plugin-container.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\plugin-container.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\default-browser-agent.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoasb.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\Wordconv.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Mozilla Firefox\updater.exe 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javacpl.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\PPTICO.usa 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1064 wrote to memory of 1192 1064 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe 80 PID 1192 wrote to memory of 2872 1192 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 81 PID 2872 wrote to memory of 3696 2872 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 82 PID 3696 wrote to memory of 1824 3696 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 83 PID 1824 wrote to memory of 3908 1824 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 84 PID 3908 wrote to memory of 3032 3908 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 85 PID 3032 wrote to memory of 2864 3032 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 86 PID 2864 wrote to memory of 4744 2864 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 87 PID 4744 wrote to memory of 3864 4744 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 88 PID 3864 wrote to memory of 1408 3864 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 89 PID 1408 wrote to memory of 2428 1408 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 90 PID 2428 wrote to memory of 3788 2428 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 91 PID 3788 wrote to memory of 2116 3788 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 92 PID 2116 wrote to memory of 4056 2116 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 93 PID 4056 wrote to memory of 4288 4056 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 94 PID 4288 wrote to memory of 1892 4288 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 95 PID 1892 wrote to memory of 1172 1892 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 96 PID 1172 wrote to memory of 5036 1172 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 97 PID 5036 wrote to memory of 4528 5036 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 98 PID 4528 wrote to memory of 2484 4528 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 99 PID 2484 wrote to memory of 3960 2484 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 100 PID 3960 wrote to memory of 4128 3960 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 101 PID 4128 wrote to memory of 5060 4128 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 102 PID 5060 wrote to memory of 2256 5060 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 103 PID 2256 wrote to memory of 4948 2256 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 104 PID 4948 wrote to memory of 2976 4948 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 105 PID 2976 wrote to memory of 3720 2976 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 106 PID 3720 wrote to memory of 1916 3720 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 107 PID 1916 wrote to memory of 2156 1916 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 108 PID 2156 wrote to memory of 996 2156 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 109 PID 996 wrote to memory of 3940 996 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 110 PID 3940 wrote to memory of 2264 3940 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 111 PID 2264 wrote to memory of 2712 2264 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 112 PID 2712 wrote to memory of 5052 2712 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 113 PID 5052 wrote to memory of 560 5052 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 114 PID 560 wrote to memory of 3948 560 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 115 PID 3948 wrote to memory of 1012 3948 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 116 PID 1012 wrote to memory of 4192 1012 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 117 PID 4192 wrote to memory of 2688 4192 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 118 PID 2688 wrote to memory of 1092 2688 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 119 PID 1092 wrote to memory of 1468 1092 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 120 PID 1468 wrote to memory of 4828 1468 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 121 PID 4828 wrote to memory of 1756 4828 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 122 PID 1756 wrote to memory of 3204 1756 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 123 PID 3204 wrote to memory of 2200 3204 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 124 PID 2200 wrote to memory of 3292 2200 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 125 PID 3292 wrote to memory of 2916 3292 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 126 PID 2916 wrote to memory of 3472 2916 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 127 PID 3472 wrote to memory of 1416 3472 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 128 PID 1416 wrote to memory of 1452 1416 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 129 PID 1452 wrote to memory of 3980 1452 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 130 PID 3980 wrote to memory of 5112 3980 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 131 PID 5112 wrote to memory of 3784 5112 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 132 PID 3784 wrote to memory of 3068 3784 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 133 PID 3068 wrote to memory of 1744 3068 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 134 PID 1744 wrote to memory of 2564 1744 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 135 PID 2564 wrote to memory of 1620 2564 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 136 PID 1620 wrote to memory of 340 1620 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 137 PID 340 wrote to memory of 3568 340 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 138 PID 3568 wrote to memory of 1676 3568 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 139 PID 1676 wrote to memory of 3692 1676 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 140 PID 3692 wrote to memory of 1472 3692 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 141 PID 1472 wrote to memory of 944 1472 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 142 PID 944 wrote to memory of 2700 944 2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa65⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa66⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa67⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa68⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa69⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa70⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa71⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa72⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa73⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa74⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa75⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa76⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa77⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa78⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa79⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa80⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa81⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa82⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa83⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa84⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa85⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa86⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa87⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa88⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa89⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa90⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa91⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa92⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa93⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa94⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa95⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa96⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa97⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa98⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa99⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa100⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa101⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa102⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa103⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa104⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa105⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa106⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa107⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa108⤵
- System Location Discovery: System Language Discovery
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa109⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa110⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa111⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa112⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa113⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa114⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa115⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa116⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa117⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa118⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa119⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa120⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa121⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-05-10_2b1fb3716206fa2dd02b890a8b5d3d84_amadey_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.usa122⤵PID:5196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-