Analysis
- max time kernel
150s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 12:59
Behavioral task
behavioral1
Sample
2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.exe
- Size 6.6MB
- Sample260702-p795haex3x
- SHA256 dce8fe3d9f11a4b62c189b1f4153f013415a465cd4c520703d0a1edd45942e45
- MD5 a5768bafe1956a600b224a29326b5038
- SHA1 59b241aa09855baea58224a724b2b29a8443b8f1
- SHA512 2b00d578b6d0ffaa0b90b5b19a92c27fabcd5ba2a942ba97804cede1664fec61b59b4136f27042a9aee77bbc9689a95fb14c0f624ae2ab783f97e4b9b3c2c0f8
- SSDEEP 98304:OPEGzbXsPN5kiQaZ5VPEGzbXsPN5kiQaZ5G:GEG45VPdEG45VPG
- TLSH T1EB666C327744CF71E46F41B099798AB6913BBD244FA647CB62807F1A3930AD26E35B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000d000000019cb6-3.dat family_shodi behavioral2/files/0x000d00000001c53f-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 572 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 5616 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 5052 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 5496 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 1264 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 1012 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 3316 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 4636 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 3052 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 2968 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 4984 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 2384 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 3644 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 792 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 2508 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 1484 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 5648 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 3604 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 4988 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 3528 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 1240 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 5544 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 5324 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 5376 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 2732 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 5492 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 5864 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 6040 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 3780 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 2628 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 2364 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 6024 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 1404 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 1104 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 3532 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 4272 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 764 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 4468 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 2708 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 2428 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 5076 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 4956 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 2760 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 5116 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 1236 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 5644 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 1888 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 5588 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 5916 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 2320 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 4796 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 360 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 52 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 260 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 1460 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 1452 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 728 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 2052 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 3844 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 2656 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 3760 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 5516 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 804 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 1456 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.exe - Drops file in Program Files directory 5 IoCs
description ioc Process File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4904 wrote to memory of 572 4904 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.exe 88 PID 572 wrote to memory of 5616 572 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 89 PID 5616 wrote to memory of 5052 5616 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 90 PID 5052 wrote to memory of 5496 5052 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 91 PID 5496 wrote to memory of 1264 5496 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 92 PID 1264 wrote to memory of 1012 1264 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 93 PID 1012 wrote to memory of 3316 1012 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 94 PID 3316 wrote to memory of 4636 3316 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 95 PID 4636 wrote to memory of 3052 4636 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 96 PID 3052 wrote to memory of 2968 3052 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 97 PID 2968 wrote to memory of 4984 2968 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 98 PID 4984 wrote to memory of 2384 4984 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 99 PID 2384 wrote to memory of 3644 2384 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 100 PID 3644 wrote to memory of 792 3644 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 101 PID 792 wrote to memory of 2508 792 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 102 PID 2508 wrote to memory of 1484 2508 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 103 PID 1484 wrote to memory of 5648 1484 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 104 PID 5648 wrote to memory of 3604 5648 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 105 PID 3604 wrote to memory of 4988 3604 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 106 PID 4988 wrote to memory of 3528 4988 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 107 PID 3528 wrote to memory of 1240 3528 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 108 PID 1240 wrote to memory of 5544 1240 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 109 PID 5544 wrote to memory of 5324 5544 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 110 PID 5324 wrote to memory of 5376 5324 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 111 PID 5376 wrote to memory of 2732 5376 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 112 PID 2732 wrote to memory of 5492 2732 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 113 PID 5492 wrote to memory of 5864 5492 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 114 PID 5864 wrote to memory of 6040 5864 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 115 PID 6040 wrote to memory of 3780 6040 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 116 PID 3780 wrote to memory of 2628 3780 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 117 PID 2628 wrote to memory of 2364 2628 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 118 PID 2364 wrote to memory of 6024 2364 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 119 PID 6024 wrote to memory of 1404 6024 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 120 PID 1404 wrote to memory of 1104 1404 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 121 PID 1104 wrote to memory of 3532 1104 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 122 PID 3532 wrote to memory of 4272 3532 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 123 PID 4272 wrote to memory of 764 4272 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 124 PID 764 wrote to memory of 4468 764 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 125 PID 4468 wrote to memory of 2708 4468 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 126 PID 2708 wrote to memory of 2428 2708 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 127 PID 2428 wrote to memory of 5076 2428 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 128 PID 5076 wrote to memory of 4956 5076 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 129 PID 4956 wrote to memory of 2760 4956 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 130 PID 2760 wrote to memory of 5116 2760 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 131 PID 5116 wrote to memory of 1236 5116 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 132 PID 1236 wrote to memory of 5644 1236 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 133 PID 5644 wrote to memory of 1888 5644 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 134 PID 1888 wrote to memory of 5588 1888 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 135 PID 5588 wrote to memory of 5916 5588 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 136 PID 5916 wrote to memory of 2320 5916 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 137 PID 2320 wrote to memory of 4796 2320 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 138 PID 4796 wrote to memory of 360 4796 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 139 PID 360 wrote to memory of 52 360 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 140 PID 52 wrote to memory of 260 52 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 141 PID 260 wrote to memory of 1460 260 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 142 PID 1460 wrote to memory of 1452 1460 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 143 PID 1452 wrote to memory of 728 1452 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 144 PID 728 wrote to memory of 2052 728 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 145 PID 2052 wrote to memory of 3844 2052 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 146 PID 3844 wrote to memory of 2656 3844 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 147 PID 2656 wrote to memory of 3760 2656 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 148 PID 3760 wrote to memory of 5516 3760 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 149 PID 5516 wrote to memory of 804 5516 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 150 PID 804 wrote to memory of 1456 804 2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa66⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa67⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa68⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa69⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa70⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa71⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa72⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa73⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa74⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa75⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa76⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa77⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa78⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa79⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa80⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa81⤵
- System Location Discovery: System Language Discovery
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa82⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa83⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa84⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa85⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa86⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa87⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa88⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa89⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa90⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa91⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa92⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa93⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa94⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa95⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa96⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa97⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa98⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa99⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa100⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa101⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa102⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa103⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa104⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa105⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa106⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa107⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa108⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa109⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa110⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa111⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa112⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa113⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa114⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa115⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa116⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa117⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa118⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa119⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa120⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa121⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_a5768bafe1956a600b224a29326b5038_akira_amadey_cloudeye_elex_hijackloader_luca-stealer_njrat_remcos_rhadamanthys.usa122⤵PID:5688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-