Analysis
- max time kernel
26s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 17:15
Behavioral task
behavioral1
Sample
2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
- Size 4.7MB
- Sample260731-vssvkayvbv
- SHA256 75671cbc8a5c43daf1c0d488da4e8739d42f0e04d8edc0ed2b60a29880daf92e
- MD5 a4a77bc9221b11d4ed39a3de5f3c4748
- SHA1 b2d043aafdfd50ceaed17af4aa790d8eeecf1a8e
- SHA512 1c0813f976379eafa983434b3966ff438c4a79894515916132fd41e19e85aa81932205fb71f6a9b5427622c7b7159834ab106abe1ef36472bb8b82561b63f87e
- SSDEEP 98304:22KGy2UgXq9ouFkULGyqobNq1N2KGy2UgXq9ouFkULGyqobNq1O:2ey2S9+ULdNyey2S9+ULdNx
- TLSH T1B836B02377E1407BE5231271942DEA35EABBE835033198E74791EE253F616C36733A86
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000600000001b86d-3.dat family_shodi behavioral2/files/0x000d00000001c581-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 4960 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5040 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4356 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4140 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3436 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4912 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 672 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 6120 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3660 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4332 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1864 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5896 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 876 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5552 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5216 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3928 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2596 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4480 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2788 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2080 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4152 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1888 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5880 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4708 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 712 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5556 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 796 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5124 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 6072 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4892 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1196 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 524 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4608 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 264 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 204 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2916 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4944 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1528 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1540 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5476 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4540 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 6124 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5036 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5916 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4680 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3932 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4372 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1976 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2556 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2972 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 980 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3520 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2204 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2168 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3348 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5808 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 4980 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3148 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5724 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 3856 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 2084 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 5884 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1636 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 1912 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4220 wrote to memory of 4960 4220 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe 89 PID 4960 wrote to memory of 5040 4960 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 90 PID 5040 wrote to memory of 4356 5040 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 91 PID 4356 wrote to memory of 4140 4356 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 92 PID 4140 wrote to memory of 3436 4140 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 93 PID 3436 wrote to memory of 4912 3436 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 94 PID 4912 wrote to memory of 672 4912 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 95 PID 672 wrote to memory of 6120 672 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 96 PID 6120 wrote to memory of 3660 6120 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 97 PID 3660 wrote to memory of 4332 3660 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 98 PID 4332 wrote to memory of 1864 4332 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 99 PID 1864 wrote to memory of 5896 1864 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 100 PID 5896 wrote to memory of 876 5896 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 101 PID 876 wrote to memory of 5552 876 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 102 PID 5552 wrote to memory of 5216 5552 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 103 PID 5216 wrote to memory of 3928 5216 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 104 PID 3928 wrote to memory of 2596 3928 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 105 PID 2596 wrote to memory of 4480 2596 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 106 PID 4480 wrote to memory of 2788 4480 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 107 PID 2788 wrote to memory of 2080 2788 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 108 PID 2080 wrote to memory of 4152 2080 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 109 PID 4152 wrote to memory of 1888 4152 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 110 PID 1888 wrote to memory of 5880 1888 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 111 PID 5880 wrote to memory of 4708 5880 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 112 PID 4708 wrote to memory of 712 4708 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 113 PID 712 wrote to memory of 5556 712 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 114 PID 5556 wrote to memory of 796 5556 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 115 PID 796 wrote to memory of 5124 796 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 116 PID 5124 wrote to memory of 6072 5124 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 117 PID 6072 wrote to memory of 4892 6072 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 118 PID 4892 wrote to memory of 1196 4892 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 119 PID 1196 wrote to memory of 524 1196 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 120 PID 524 wrote to memory of 4608 524 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 121 PID 4608 wrote to memory of 264 4608 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 122 PID 264 wrote to memory of 204 264 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 123 PID 204 wrote to memory of 2916 204 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 124 PID 2916 wrote to memory of 4944 2916 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 125 PID 4944 wrote to memory of 1528 4944 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 126 PID 1528 wrote to memory of 1540 1528 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 127 PID 1540 wrote to memory of 5476 1540 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 128 PID 5476 wrote to memory of 4540 5476 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 129 PID 4540 wrote to memory of 6124 4540 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 130 PID 6124 wrote to memory of 5036 6124 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 131 PID 5036 wrote to memory of 5916 5036 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 132 PID 5916 wrote to memory of 4680 5916 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 133 PID 4680 wrote to memory of 3932 4680 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 134 PID 3932 wrote to memory of 4372 3932 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 135 PID 4372 wrote to memory of 1976 4372 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 136 PID 1976 wrote to memory of 2556 1976 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 137 PID 2556 wrote to memory of 2972 2556 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 138 PID 2972 wrote to memory of 980 2972 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 139 PID 980 wrote to memory of 3520 980 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 140 PID 3520 wrote to memory of 2204 3520 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 141 PID 2204 wrote to memory of 2168 2204 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 142 PID 2168 wrote to memory of 3348 2168 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 143 PID 3348 wrote to memory of 5808 3348 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 144 PID 5808 wrote to memory of 4980 5808 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 145 PID 4980 wrote to memory of 3148 4980 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 146 PID 3148 wrote to memory of 5724 3148 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 147 PID 5724 wrote to memory of 3856 5724 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 148 PID 3856 wrote to memory of 2084 3856 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 149 PID 2084 wrote to memory of 5884 2084 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 150 PID 5884 wrote to memory of 1636 5884 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 151 PID 1636 wrote to memory of 1912 1636 2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa65⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa66⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa67⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa68⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa69⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa70⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa71⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa72⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa73⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa74⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa75⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa76⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa77⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa78⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa79⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa80⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa81⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa82⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa83⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa84⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa85⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa86⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa87⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa88⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa89⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa90⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa91⤵PID:5828
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa92⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa93⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa94⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa95⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa96⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa97⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa98⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa99⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa100⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa101⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa102⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa103⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa104⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa105⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa106⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa107⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa108⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa109⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa110⤵
- System Location Discovery: System Language Discovery
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa111⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa112⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa113⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa114⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa115⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa116⤵
- System Location Discovery: System Language Discovery
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa117⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa118⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa119⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa120⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa121⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usaC:\Users\Admin\AppData\Local\Temp\2026-07-31_a4a77bc9221b11d4ed39a3de5f3c4748_amadey_cloudeye_elex_hellokitty_luca-stealer_njrat_rhadamanthys_smoke-loader.usa122⤵PID:4924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-