Analysis
- max time kernel
39s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/07/2026, 00:18
Behavioral task
behavioral1
Sample
2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
Resource
win11ltsc2024-20260706-en
12 signatures
150 seconds
General
- Target 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
- Size 3.7MB
- Sample260707-alpjcaes8x
- SHA256 e3bd609c56e1fac296eb80578568b2c8fa1e4eff7bd9c720e90c78446c265254
- MD5 e6b068226604c6e15ca1c3a734fc4f16
- SHA1 b68f954d10df2841cebe608478676d449728b864
- SHA512 047d38f2abb899674899ab49183093b14d6f916e74c91e508d8a522903a073306e046232c95125a68a50777fd553f9c779d3a4a7067a8e7551e8ddb984d83185
- SSDEEP 98304:s2KGy2UgXq9ouFkULGyqobn2KGy2UgXq9ouFkULGyqobS:sey2S9+ULdney2S9+ULdS
- TLSH T1AD06BE13B7D14076E8076171A12DBA39E9AFE8340321A8E747D2EC617F71AC36737686
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral1/files/0x000a0000000242c3-2.dat family_shodi behavioral1/files/0x00080000000244a8-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 4324 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4352 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3380 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2212 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4924 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1120 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3064 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3820 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1828 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3996 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4968 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1472 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3348 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 844 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4052 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4696 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3520 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4156 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3876 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1100 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1620 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4272 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1760 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2928 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1268 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4884 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5068 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4480 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3888 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2552 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1876 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3988 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2788 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 768 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4268 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1076 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3448 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3092 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2624 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2848 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1932 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3104 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3080 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1848 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4596 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 220 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4112 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1512 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4256 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 888 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4548 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4316 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2244 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4528 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3672 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4780 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4908 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2656 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4896 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4900 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4472 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2284 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3460 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5040 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 26 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.usa 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.usa 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.usa 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.usa 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.usa 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.usa 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.usa 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.usa 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4580 wrote to memory of 4324 4580 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe 86 PID 4324 wrote to memory of 4352 4324 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 87 PID 4352 wrote to memory of 3380 4352 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 88 PID 3380 wrote to memory of 2212 3380 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 89 PID 2212 wrote to memory of 4924 2212 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 90 PID 4924 wrote to memory of 1120 4924 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 91 PID 1120 wrote to memory of 3064 1120 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 92 PID 3064 wrote to memory of 3820 3064 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 93 PID 3820 wrote to memory of 1828 3820 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 94 PID 1828 wrote to memory of 3996 1828 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 95 PID 3996 wrote to memory of 4968 3996 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 96 PID 4968 wrote to memory of 1472 4968 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 97 PID 1472 wrote to memory of 3348 1472 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 98 PID 3348 wrote to memory of 844 3348 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 99 PID 844 wrote to memory of 4052 844 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 100 PID 4052 wrote to memory of 4696 4052 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 101 PID 4696 wrote to memory of 3520 4696 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 102 PID 3520 wrote to memory of 4156 3520 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 103 PID 4156 wrote to memory of 3876 4156 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 104 PID 3876 wrote to memory of 1100 3876 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 105 PID 1100 wrote to memory of 1620 1100 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 106 PID 1620 wrote to memory of 4272 1620 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 107 PID 4272 wrote to memory of 1760 4272 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 108 PID 1760 wrote to memory of 2928 1760 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 109 PID 2928 wrote to memory of 1268 2928 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 110 PID 1268 wrote to memory of 4884 1268 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 111 PID 4884 wrote to memory of 5068 4884 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 112 PID 5068 wrote to memory of 4480 5068 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 113 PID 4480 wrote to memory of 3888 4480 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 114 PID 3888 wrote to memory of 2552 3888 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 115 PID 2552 wrote to memory of 1876 2552 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 116 PID 1876 wrote to memory of 3988 1876 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 117 PID 3988 wrote to memory of 2788 3988 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 118 PID 2788 wrote to memory of 768 2788 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 119 PID 768 wrote to memory of 4268 768 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 120 PID 4268 wrote to memory of 1076 4268 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 121 PID 1076 wrote to memory of 3448 1076 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 122 PID 3448 wrote to memory of 3092 3448 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 123 PID 3092 wrote to memory of 2624 3092 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 124 PID 2624 wrote to memory of 2848 2624 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 125 PID 2848 wrote to memory of 1932 2848 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 126 PID 1932 wrote to memory of 3104 1932 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 127 PID 3104 wrote to memory of 3080 3104 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 128 PID 3080 wrote to memory of 1848 3080 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 129 PID 1848 wrote to memory of 4596 1848 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 130 PID 4596 wrote to memory of 220 4596 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 131 PID 220 wrote to memory of 4112 220 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 132 PID 4112 wrote to memory of 1512 4112 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 133 PID 1512 wrote to memory of 4256 1512 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 134 PID 4256 wrote to memory of 888 4256 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 135 PID 888 wrote to memory of 4548 888 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 136 PID 4548 wrote to memory of 4316 4548 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 137 PID 4316 wrote to memory of 2244 4316 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 138 PID 2244 wrote to memory of 4528 2244 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 139 PID 4528 wrote to memory of 3672 4528 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 140 PID 3672 wrote to memory of 4780 3672 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 141 PID 4780 wrote to memory of 4908 4780 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 142 PID 4908 wrote to memory of 2656 4908 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 143 PID 2656 wrote to memory of 4896 2656 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 144 PID 4896 wrote to memory of 4900 4896 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 145 PID 4900 wrote to memory of 4472 4900 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 146 PID 4472 wrote to memory of 2284 4472 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 147 PID 2284 wrote to memory of 3460 2284 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 148 PID 3460 wrote to memory of 5040 3460 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa65⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa66⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa67⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa68⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa69⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa70⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa71⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa72⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa73⤵
- System Location Discovery: System Language Discovery
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa74⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa75⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa76⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa77⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa78⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa79⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa80⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa81⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa82⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa83⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa84⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa85⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa86⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa87⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa88⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa89⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa90⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa91⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa92⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa93⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa94⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa95⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa96⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa97⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa98⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa99⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa100⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa101⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa102⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa103⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa104⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa105⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa106⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa107⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa108⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa109⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa110⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa111⤵
- System Location Discovery: System Language Discovery
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa112⤵PID:5192
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa113⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa114⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa115⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa116⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa117⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa118⤵PID:5288
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa119⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa120⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa121⤵
- System Location Discovery: System Language Discovery
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa122⤵PID:5352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-