Analysis
- max time kernel
29s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 09:46
Behavioral task
behavioral1
Sample
2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.exe
- Size 8.8MB
- Sample260810-lrn1jsfc69
- SHA256 a54f8b22e4bf219a2f58bc74f2a748e48eef006240744df6fbcaa37ca4fe1def
- MD5 b10328547c475b7bf996611353b7188c
- SHA1 2871dd2b6556526989436944b537436ff3f70a82
- SHA512 44183ff8b1ab715e80da72df11c4fe463078d294b28cadf9bbe4201d5d949ba72fe935eeeb3962c9a3bb1e4246b003d128a9832553aad23970970302901bd558
- SSDEEP 98304:t+4LkGWQtZ/K0tGOFWVRuLftS+4LkGWQtZ/K0tGOFWVRuLftS:JBWyZ/K0ttYVA+BWyZ/K0ttYVAE
- TLSH T127967B13F58501ACD05EC079CF4A9632EB2678590BF175EF3A906AE22A77BD03B39711
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000c000000016cd6-3.dat family_shodi behavioral2/files/0x000c00000001c556-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 4376 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4920 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4772 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 5144 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3880 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 5412 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2844 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 944 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 6092 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4656 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3764 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4228 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4908 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4544 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4448 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2460 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1812 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4596 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 5664 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3352 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4676 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3552 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 5656 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3380 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 5940 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 576 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1540 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 408 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 268 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 124 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1112 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 5648 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 6016 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 5716 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 5788 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 5004 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3792 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1528 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1264 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1068 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3620 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1256 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2088 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2804 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4592 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1248 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2816 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1748 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4200 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1668 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 5096 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 3008 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4336 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1384 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4288 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 1064 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2924 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 6104 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4408 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 2100 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 5268 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 5804 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 5288 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 4980 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 884 wrote to memory of 4376 884 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.exe 89 PID 4376 wrote to memory of 4920 4376 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 90 PID 4920 wrote to memory of 4772 4920 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 91 PID 4772 wrote to memory of 5144 4772 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 92 PID 5144 wrote to memory of 3880 5144 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 93 PID 3880 wrote to memory of 5412 3880 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 94 PID 5412 wrote to memory of 2844 5412 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 95 PID 2844 wrote to memory of 944 2844 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 96 PID 944 wrote to memory of 6092 944 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 97 PID 6092 wrote to memory of 4656 6092 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 98 PID 4656 wrote to memory of 3764 4656 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 99 PID 3764 wrote to memory of 4228 3764 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 100 PID 4228 wrote to memory of 4908 4228 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 101 PID 4908 wrote to memory of 4544 4908 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 102 PID 4544 wrote to memory of 4448 4544 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 103 PID 4448 wrote to memory of 2460 4448 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 104 PID 2460 wrote to memory of 1812 2460 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 105 PID 1812 wrote to memory of 4596 1812 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 106 PID 4596 wrote to memory of 5664 4596 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 107 PID 5664 wrote to memory of 3352 5664 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 108 PID 3352 wrote to memory of 4676 3352 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 109 PID 4676 wrote to memory of 3552 4676 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 110 PID 3552 wrote to memory of 5656 3552 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 111 PID 5656 wrote to memory of 3380 5656 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 112 PID 3380 wrote to memory of 5940 3380 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 113 PID 5940 wrote to memory of 576 5940 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 114 PID 576 wrote to memory of 1540 576 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 115 PID 1540 wrote to memory of 408 1540 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 116 PID 408 wrote to memory of 268 408 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 117 PID 268 wrote to memory of 124 268 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 118 PID 124 wrote to memory of 1112 124 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 119 PID 1112 wrote to memory of 5648 1112 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 120 PID 5648 wrote to memory of 6016 5648 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 121 PID 6016 wrote to memory of 5716 6016 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 122 PID 5716 wrote to memory of 5788 5716 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 123 PID 5788 wrote to memory of 5004 5788 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 124 PID 5004 wrote to memory of 3792 5004 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 125 PID 3792 wrote to memory of 1528 3792 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 126 PID 1528 wrote to memory of 1264 1528 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 127 PID 1264 wrote to memory of 1068 1264 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 128 PID 1068 wrote to memory of 3620 1068 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 129 PID 3620 wrote to memory of 1256 3620 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 130 PID 1256 wrote to memory of 2088 1256 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 131 PID 2088 wrote to memory of 2804 2088 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 132 PID 2804 wrote to memory of 4592 2804 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 133 PID 4592 wrote to memory of 1248 4592 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 134 PID 1248 wrote to memory of 2816 1248 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 135 PID 2816 wrote to memory of 1748 2816 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 136 PID 1748 wrote to memory of 4200 1748 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 137 PID 4200 wrote to memory of 1668 4200 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 138 PID 1668 wrote to memory of 5096 1668 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 139 PID 5096 wrote to memory of 3008 5096 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 140 PID 3008 wrote to memory of 4336 3008 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 141 PID 4336 wrote to memory of 1384 4336 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 142 PID 1384 wrote to memory of 4288 1384 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 143 PID 4288 wrote to memory of 1064 4288 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 144 PID 1064 wrote to memory of 2924 1064 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 145 PID 2924 wrote to memory of 6104 2924 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 146 PID 6104 wrote to memory of 4408 6104 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 147 PID 4408 wrote to memory of 2100 4408 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 148 PID 2100 wrote to memory of 5268 2100 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 149 PID 5268 wrote to memory of 5804 5268 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 150 PID 5804 wrote to memory of 5288 5804 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 151 PID 5288 wrote to memory of 4980 5288 2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa65⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa66⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa67⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa68⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa69⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa70⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa71⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa72⤵PID:5508
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa73⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa74⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa75⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa76⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa77⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa78⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa79⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa80⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa81⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa82⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa83⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa84⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa85⤵
- System Location Discovery: System Language Discovery
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa86⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa87⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa88⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa89⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa90⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa91⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa92⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa93⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa94⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa95⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa96⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa97⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa98⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa99⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa100⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa101⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa102⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa103⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa104⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa105⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa106⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa107⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa108⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa109⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa110⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa111⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa112⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa113⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa114⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa115⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa116⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa117⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa118⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa119⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa120⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa121⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_b10328547c475b7bf996611353b7188c_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_rhadamanthys_vidar.usa122⤵PID:1820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-