Analysis
- max time kernel
75s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 09:46
Behavioral task
behavioral1
Sample
2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.exe
- Size 8.8MB
- Sample260810-lrn1jsfc69
- SHA256 a54f8b22e4bf219a2f58bc74f2a748e48eef006240744df6fbcaa37ca4fe1def
- MD5 b10328547c475b7bf996611353b7188c
- SHA1 2871dd2b6556526989436944b537436ff3f70a82
- SHA512 44183ff8b1ab715e80da72df11c4fe463078d294b28cadf9bbe4201d5d949ba72fe935eeeb3962c9a3bb1e4246b003d128a9832553aad23970970302901bd558
- SSDEEP 98304:t+4LkGWQtZ/K0tGOFWVRuLftS+4LkGWQtZ/K0tGOFWVRuLftS:JBWyZ/K0ttYVA+BWyZ/K0ttYVAE
- TLSH T127967B13F58501ACD05EC079CF4A9632EB2678590BF175EF3A906AE22A77BD03B39711
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral1/files/0x000c000000024328-3.dat family_shodi behavioral1/files/0x000d00000002448c-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 1272 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2248 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3840 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3196 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2364 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3724 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2172 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2764 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2972 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2116 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1172 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2516 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1588 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2924 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1904 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4380 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3580 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4524 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2396 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2908 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3772 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2900 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4384 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4124 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2620 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 5028 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4328 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 368 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 212 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 752 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3268 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1772 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4704 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 808 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1084 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2636 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3352 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3956 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4024 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2108 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1756 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3336 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1944 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3860 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1660 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1044 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4104 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4948 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4056 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 736 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2992 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 696 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4976 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3156 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4868 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3144 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3612 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4724 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4776 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3240 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3364 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1144 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2372 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4216 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaws.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javacpl.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaw.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\7-Zip\7zG.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\7-Zip\Uninstall.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CNFNOT32.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoev.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File created \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.usa 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4168 wrote to memory of 1272 4168 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.exe 88 PID 1272 wrote to memory of 2248 1272 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 89 PID 2248 wrote to memory of 3840 2248 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 90 PID 3840 wrote to memory of 3196 3840 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 91 PID 3196 wrote to memory of 2364 3196 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 92 PID 2364 wrote to memory of 3724 2364 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 93 PID 3724 wrote to memory of 2172 3724 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 94 PID 2172 wrote to memory of 2764 2172 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 95 PID 2764 wrote to memory of 2972 2764 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 96 PID 2972 wrote to memory of 2116 2972 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 97 PID 2116 wrote to memory of 1172 2116 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 98 PID 1172 wrote to memory of 2516 1172 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 99 PID 2516 wrote to memory of 1588 2516 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 100 PID 1588 wrote to memory of 2924 1588 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 101 PID 2924 wrote to memory of 1904 2924 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 102 PID 1904 wrote to memory of 4380 1904 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 103 PID 4380 wrote to memory of 3580 4380 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 104 PID 3580 wrote to memory of 4524 3580 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 105 PID 4524 wrote to memory of 2396 4524 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 106 PID 2396 wrote to memory of 2908 2396 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 107 PID 2908 wrote to memory of 3772 2908 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 108 PID 3772 wrote to memory of 2900 3772 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 109 PID 2900 wrote to memory of 4384 2900 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 110 PID 4384 wrote to memory of 4124 4384 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 111 PID 4124 wrote to memory of 2620 4124 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 112 PID 2620 wrote to memory of 5028 2620 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 113 PID 5028 wrote to memory of 4328 5028 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 114 PID 4328 wrote to memory of 368 4328 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 115 PID 368 wrote to memory of 212 368 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 116 PID 212 wrote to memory of 752 212 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 117 PID 752 wrote to memory of 3268 752 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 118 PID 3268 wrote to memory of 1772 3268 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 119 PID 1772 wrote to memory of 4704 1772 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 120 PID 4704 wrote to memory of 808 4704 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 121 PID 808 wrote to memory of 1084 808 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 122 PID 1084 wrote to memory of 2636 1084 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 123 PID 2636 wrote to memory of 3352 2636 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 124 PID 3352 wrote to memory of 3956 3352 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 125 PID 3956 wrote to memory of 4024 3956 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 126 PID 4024 wrote to memory of 2108 4024 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 127 PID 2108 wrote to memory of 1756 2108 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 128 PID 1756 wrote to memory of 3336 1756 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 129 PID 3336 wrote to memory of 1944 3336 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 130 PID 1944 wrote to memory of 3860 1944 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 131 PID 3860 wrote to memory of 1660 3860 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 132 PID 1660 wrote to memory of 1044 1660 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 133 PID 1044 wrote to memory of 4104 1044 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 134 PID 4104 wrote to memory of 4948 4104 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 135 PID 4948 wrote to memory of 4056 4948 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 136 PID 4056 wrote to memory of 736 4056 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 137 PID 736 wrote to memory of 2992 736 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 138 PID 2992 wrote to memory of 696 2992 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 139 PID 696 wrote to memory of 4976 696 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 140 PID 4976 wrote to memory of 3156 4976 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 141 PID 3156 wrote to memory of 4868 3156 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 142 PID 4868 wrote to memory of 3144 4868 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 143 PID 3144 wrote to memory of 3612 3144 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 144 PID 3612 wrote to memory of 4724 3612 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 145 PID 4724 wrote to memory of 4776 4724 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 146 PID 4776 wrote to memory of 3240 4776 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 147 PID 3240 wrote to memory of 3364 3240 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 148 PID 3364 wrote to memory of 1144 3364 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 149 PID 1144 wrote to memory of 2372 1144 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 150 PID 2372 wrote to memory of 4216 2372 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa65⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa66⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa67⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa68⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa69⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa70⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa71⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa72⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa73⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa74⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa75⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa76⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa77⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa78⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa79⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa80⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa81⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa82⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa83⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa84⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa85⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa86⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa87⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa88⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa89⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa90⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa91⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa92⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa93⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa94⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa95⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa96⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa97⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa98⤵PID:5192
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa99⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa100⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa101⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa102⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa103⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa104⤵PID:5288
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa105⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa106⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa107⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa108⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa109⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa110⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa111⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa112⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa113⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa114⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa115⤵PID:5464
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa116⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa117⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa118⤵PID:5512
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa119⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa120⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa121⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa122⤵PID:5576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-