Analysis
- max time kernel
36s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 00:18
Behavioral task
behavioral1
Sample
2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
Resource
win11ltsc2024-20260706-en
12 signatures
150 seconds
General
- Target 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
- Size 3.7MB
- Sample260707-alpjcaes8x
- SHA256 e3bd609c56e1fac296eb80578568b2c8fa1e4eff7bd9c720e90c78446c265254
- MD5 e6b068226604c6e15ca1c3a734fc4f16
- SHA1 b68f954d10df2841cebe608478676d449728b864
- SHA512 047d38f2abb899674899ab49183093b14d6f916e74c91e508d8a522903a073306e046232c95125a68a50777fd553f9c779d3a4a7067a8e7551e8ddb984d83185
- SSDEEP 98304:s2KGy2UgXq9ouFkULGyqobn2KGy2UgXq9ouFkULGyqobS:sey2S9+ULdney2S9+ULdS
- TLSH T1AD06BE13B7D14076E8076171A12DBA39E9AFE8340321A8E747D2EC617F71AC36737686
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000600000001b865-3.dat family_shodi behavioral2/files/0x000e00000001c59e-68.dat family_shodi - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000\Software\Microsoft\Active Setup\Installed Components Process not Found - Executes dropped EXE 64 IoCs
pid Process 4120 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4984 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1912 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5432 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4924 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5456 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4220 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3400 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4956 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2484 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3028 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2824 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 6068 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4460 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4988 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4380 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3364 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4656 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2496 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1444 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2808 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5824 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3840 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3216 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 6016 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4136 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2188 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5780 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3032 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2076 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5524 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5660 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5672 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 6136 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3432 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2308 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2820 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3384 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3940 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 6128 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1392 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2472 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 6120 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3844 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 684 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3684 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1456 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5576 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2732 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3224 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2176 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4820 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5496 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 296 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5872 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5900 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 624 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3884 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1956 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3888 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3284 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2440 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5248 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5396 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: Process not Found File opened (read-only) \??\F: Process not Found - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 9 IoCs
description ioc Process File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.usa 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa - Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings Process not Found Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell Process not Found Key created \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ Process not Found Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3437697693-2283162250-3003737219-1000\{35564F32-4977-43B2-85A7-6DC78C0C97F3} Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ Process not Found - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeShutdownPrivilege 6512 Process not Found Token: SeCreatePagefilePrivilege 6512 Process not Found Token: SeShutdownPrivilege 6512 Process not Found Token: SeCreatePagefilePrivilege 6512 Process not Found Token: SeShutdownPrivilege 6512 Process not Found Token: SeCreatePagefilePrivilege 6512 Process not Found Token: SeShutdownPrivilege 6512 Process not Found Token: SeCreatePagefilePrivilege 6512 Process not Found Token: SeShutdownPrivilege 6512 Process not Found Token: SeCreatePagefilePrivilege 6512 Process not Found - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4428 Process not Found 6512 Process not Found 6512 Process not Found 6512 Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1120 wrote to memory of 4120 1120 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe 87 PID 4120 wrote to memory of 4984 4120 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 88 PID 4984 wrote to memory of 1912 4984 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 89 PID 1912 wrote to memory of 5432 1912 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 90 PID 5432 wrote to memory of 4924 5432 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 91 PID 4924 wrote to memory of 5456 4924 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 92 PID 5456 wrote to memory of 4220 5456 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 93 PID 4220 wrote to memory of 3400 4220 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 94 PID 3400 wrote to memory of 4956 3400 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 95 PID 4956 wrote to memory of 2484 4956 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 96 PID 2484 wrote to memory of 3028 2484 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 97 PID 3028 wrote to memory of 2824 3028 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 98 PID 2824 wrote to memory of 6068 2824 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 99 PID 6068 wrote to memory of 4460 6068 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 100 PID 4460 wrote to memory of 4988 4460 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 101 PID 4988 wrote to memory of 4380 4988 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 102 PID 4380 wrote to memory of 3364 4380 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 103 PID 3364 wrote to memory of 4656 3364 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 104 PID 4656 wrote to memory of 2496 4656 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 105 PID 2496 wrote to memory of 1444 2496 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 106 PID 1444 wrote to memory of 2808 1444 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 107 PID 2808 wrote to memory of 5824 2808 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 108 PID 5824 wrote to memory of 3840 5824 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 109 PID 3840 wrote to memory of 3216 3840 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 110 PID 3216 wrote to memory of 6016 3216 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 111 PID 6016 wrote to memory of 4136 6016 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 112 PID 4136 wrote to memory of 2188 4136 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 113 PID 2188 wrote to memory of 5780 2188 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 114 PID 5780 wrote to memory of 3032 5780 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 115 PID 3032 wrote to memory of 2076 3032 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 116 PID 2076 wrote to memory of 5524 2076 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 117 PID 5524 wrote to memory of 5660 5524 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 118 PID 5660 wrote to memory of 5672 5660 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 119 PID 5672 wrote to memory of 6136 5672 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 120 PID 6136 wrote to memory of 3432 6136 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 121 PID 3432 wrote to memory of 2308 3432 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 122 PID 2308 wrote to memory of 2820 2308 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 123 PID 2820 wrote to memory of 3384 2820 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 124 PID 3384 wrote to memory of 3940 3384 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 125 PID 3940 wrote to memory of 6128 3940 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 126 PID 6128 wrote to memory of 1392 6128 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 127 PID 1392 wrote to memory of 2472 1392 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 128 PID 2472 wrote to memory of 6120 2472 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 129 PID 6120 wrote to memory of 3844 6120 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 130 PID 3844 wrote to memory of 684 3844 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 131 PID 684 wrote to memory of 3684 684 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 132 PID 3684 wrote to memory of 1456 3684 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 133 PID 1456 wrote to memory of 5576 1456 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 134 PID 5576 wrote to memory of 2732 5576 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 135 PID 2732 wrote to memory of 3224 2732 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 136 PID 3224 wrote to memory of 2176 3224 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 137 PID 2176 wrote to memory of 4820 2176 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 138 PID 4820 wrote to memory of 5496 4820 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 139 PID 5496 wrote to memory of 296 5496 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 140 PID 296 wrote to memory of 5872 296 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 141 PID 5872 wrote to memory of 5900 5872 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 142 PID 5900 wrote to memory of 624 5900 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 143 PID 624 wrote to memory of 3884 624 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 144 PID 3884 wrote to memory of 1956 3884 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 145 PID 1956 wrote to memory of 3888 1956 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 146 PID 3888 wrote to memory of 3284 3888 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 147 PID 3284 wrote to memory of 2440 3284 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 148 PID 2440 wrote to memory of 5248 2440 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 149 PID 5248 wrote to memory of 5396 5248 2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa65⤵
- Executes dropped EXE
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa66⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa67⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa68⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa69⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa70⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa71⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa72⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa73⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa74⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa75⤵
- System Location Discovery: System Language Discovery
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa76⤵
- System Location Discovery: System Language Discovery
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa77⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa78⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa79⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa80⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa81⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa82⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa83⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa84⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa85⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa86⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa87⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa88⤵
- System Location Discovery: System Language Discovery
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa89⤵
- System Location Discovery: System Language Discovery
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa90⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa91⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa92⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa93⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa94⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa95⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa96⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa97⤵
- System Location Discovery: System Language Discovery
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa98⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa99⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa100⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa101⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa102⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa103⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa104⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa105⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa106⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa107⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa108⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa109⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa110⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa111⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa112⤵
- System Location Discovery: System Language Discovery
PID:972 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa113⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa114⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa115⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa116⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa117⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa118⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa119⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa120⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa121⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_e6b068226604c6e15ca1c3a734fc4f16_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa122⤵PID:1452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-