Analysis
- max time kernel
150s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/04/2026, 14:09
Behavioral task
behavioral1
Sample
2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe
Resource
win10v2004-20260130-en
8 signatures
150 seconds
General
- Target 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe
- Size 10.9MB
- Sample260424-rf9e1acz2v
- SHA256 0d01914172c7b7f2a17e977d77844c3f6a39f35af7d3e6ee5b99566f4d65aed7
- MD5 cf39a82bbaefc085943e76c60fe5b210
- SHA1 2711c1f5cc3d6fc0f5c546b7764d746c19c32276
- SHA512 9efaf0233a0418881b11ca9363613859fe3d10661208c1ed063c4b17da1351228ff388053c073b6ded610e3fa6f2190c1373561ba0f6ed38c52702604c82ec0f
- SSDEEP 196608:Hl5XjvUeSJEul4sz4l5XjvUeSJEul4szm:HTzUeSqFa4TzUeSqFam
- TLSH T15CC67C217AC58638F5B741B0997CAF76802EFD340B7544CB67C06E266970AC36A36F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral1/files/0x00180000000241f1-2.dat family_shodi behavioral1/files/0x00070000000243cc-102.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 2276 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3756 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2212 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4508 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1664 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2164 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3392 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2976 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4636 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1832 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4624 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3408 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4836 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1924 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1780 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3516 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1040 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 5064 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3708 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2472 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3836 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3312 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3488 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3368 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3320 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4472 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3100 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4832 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4984 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4740 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4916 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3816 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3604 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2248 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2128 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3600 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3908 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2636 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 916 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3964 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1996 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2980 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3800 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3704 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1128 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 948 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3032 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4548 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2060 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3156 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4936 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1472 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 224 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2928 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1872 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1012 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4652 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1948 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4232 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4736 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4564 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 872 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 456 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3668 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu Process not Found File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu Process not Found File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu Process not Found File created C:\Windows\SysWOW64\UsaShohdi.asu Process not Found - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.usa Process not Found File created \??\c:\Program Files\Microsoft Office\root\Office16\Wordconv.exe Process not Found File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process not Found File opened for modification \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.usa Process not Found File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.usa Process not Found File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.usa Process not Found File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOUC.usa Process not Found File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.usa Process not Found File created \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe Process not Found File created \??\c:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE Process not Found File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.usa Process not Found File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.usa Process not Found File created \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe Process not Found File created \??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe Process not Found File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa Process not Found File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE Process not Found File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe Process not Found File created \??\c:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe Process not Found File created \??\c:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe Process not Found File created \??\c:\Program Files\Microsoft Office\root\Office16\misc.exe Process not Found File created \??\c:\Program Files\VideoLAN\VLC\vlc.exe Process not Found File opened for modification \??\c:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.usa Process not Found File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.usa Process not Found File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe Process not Found File created \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE Process not Found File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoev.usa Process not Found File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.usa Process not Found File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe Process not Found File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE Process not Found File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.usa Process not Found File created \??\c:\Program Files\Mozilla Firefox\updater.exe Process not Found File created \??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE Process not Found File created \??\c:\Program Files\VideoLAN\VLC\uninstall.exe Process not Found File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe Process not Found File created \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Process not Found File created \??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe Process not Found File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe Process not Found File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.usa Process not Found File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.usa Process not Found File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE Process not Found File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSREC.usa Process not Found File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\Wordconv.usa Process not Found File opened for modification \??\c:\Program Files\7-Zip\Uninstall.usa Process not Found File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE Process not Found File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.usa Process not Found File created \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe Process not Found File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.usa Process not Found File created \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe Process not Found File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.usa Process not Found File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaw.usa Process not Found File created \??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE Process not Found File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.usa Process not Found File opened for modification \??\c:\Program Files\Mozilla Firefox\firefox.usa Process not Found File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process not Found File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe Process not Found File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe Process not Found File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe Process not Found File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe Process not Found File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.usa Process not Found File created \??\c:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE Process not Found File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoia.usa Process not Found File created \??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE Process not Found File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.usa Process not Found File created \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe Process not Found - Program crash 1 IoCs
pid pid_target Process procid_target 36556 36312 Process not Found 2153 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2276 2824 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe 84 PID 2276 wrote to memory of 3756 2276 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 85 PID 3756 wrote to memory of 2212 3756 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 86 PID 2212 wrote to memory of 4508 2212 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 87 PID 4508 wrote to memory of 1664 4508 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 88 PID 1664 wrote to memory of 2164 1664 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 89 PID 2164 wrote to memory of 3392 2164 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 90 PID 3392 wrote to memory of 2976 3392 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 91 PID 2976 wrote to memory of 4636 2976 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 92 PID 4636 wrote to memory of 1832 4636 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 93 PID 1832 wrote to memory of 4624 1832 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 94 PID 4624 wrote to memory of 3408 4624 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 95 PID 3408 wrote to memory of 4836 3408 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 96 PID 4836 wrote to memory of 1924 4836 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 97 PID 1924 wrote to memory of 1780 1924 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 98 PID 1780 wrote to memory of 3516 1780 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 99 PID 3516 wrote to memory of 1040 3516 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 100 PID 1040 wrote to memory of 5064 1040 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 101 PID 5064 wrote to memory of 3708 5064 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 102 PID 3708 wrote to memory of 2472 3708 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 103 PID 2472 wrote to memory of 3836 2472 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 104 PID 3836 wrote to memory of 3312 3836 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 105 PID 3312 wrote to memory of 3488 3312 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 106 PID 3488 wrote to memory of 3368 3488 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 107 PID 3368 wrote to memory of 3320 3368 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 108 PID 3320 wrote to memory of 4472 3320 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 109 PID 4472 wrote to memory of 3100 4472 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 110 PID 3100 wrote to memory of 4832 3100 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 111 PID 4832 wrote to memory of 4984 4832 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 112 PID 4984 wrote to memory of 4740 4984 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 113 PID 4740 wrote to memory of 4916 4740 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 114 PID 4916 wrote to memory of 3816 4916 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 115 PID 3816 wrote to memory of 3604 3816 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 116 PID 3604 wrote to memory of 2248 3604 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 117 PID 2248 wrote to memory of 2128 2248 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 118 PID 2128 wrote to memory of 3600 2128 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 119 PID 3600 wrote to memory of 3908 3600 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 120 PID 3908 wrote to memory of 2636 3908 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 121 PID 2636 wrote to memory of 916 2636 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 122 PID 916 wrote to memory of 3964 916 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 123 PID 3964 wrote to memory of 1996 3964 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 124 PID 1996 wrote to memory of 2980 1996 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 125 PID 2980 wrote to memory of 3800 2980 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 126 PID 3800 wrote to memory of 3704 3800 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 127 PID 3704 wrote to memory of 1128 3704 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 128 PID 1128 wrote to memory of 948 1128 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 129 PID 948 wrote to memory of 3032 948 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 130 PID 3032 wrote to memory of 4548 3032 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 131 PID 4548 wrote to memory of 2060 4548 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 132 PID 2060 wrote to memory of 3156 2060 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 133 PID 3156 wrote to memory of 4936 3156 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 134 PID 4936 wrote to memory of 1472 4936 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 135 PID 1472 wrote to memory of 224 1472 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 136 PID 224 wrote to memory of 2928 224 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 137 PID 2928 wrote to memory of 1872 2928 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 138 PID 1872 wrote to memory of 1012 1872 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 139 PID 1012 wrote to memory of 4652 1012 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 140 PID 4652 wrote to memory of 1948 4652 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 141 PID 1948 wrote to memory of 4232 1948 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 142 PID 4232 wrote to memory of 4736 4232 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 143 PID 4736 wrote to memory of 4564 4736 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 144 PID 4564 wrote to memory of 872 4564 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 145 PID 872 wrote to memory of 456 872 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 146 PID 456 wrote to memory of 3668 456 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa66⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa67⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa68⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa69⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa70⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa71⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa72⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa73⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa74⤵
- System Location Discovery: System Language Discovery
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa75⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa76⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa77⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa78⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa79⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa80⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa81⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa82⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa83⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa84⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa85⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa86⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa87⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa88⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa89⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa90⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa91⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa92⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa93⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa94⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa95⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa96⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa97⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa98⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa99⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa100⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa101⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa102⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa103⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa104⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa105⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa106⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa107⤵
- System Location Discovery: System Language Discovery
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa108⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa109⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa110⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa111⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa112⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa113⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa114⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa115⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa116⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa117⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa118⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa119⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa120⤵PID:5500
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa121⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa122⤵PID:5532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-