Analysis
- max time kernel
57s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 00:41
Behavioral task
behavioral1
Sample
2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe
- Size 5.5MB
- Sample260808-a18krswfpb
- SHA256 50b213ca00cb5fd2b4b31ac1c71a5daae77084c319081b184853125ae73304d6
- MD5 c2f26d74464ca7130f33f3ef964e6c23
- SHA1 eeb323c3ca964637611dd8cd4ad8e26d7dad8c86
- SHA512 24a02a3457d70ba00a9930d874893656ea8ffa34d2c847d82a7be41e06f80a2a7a9edd407d3249c86c98efea74d7d9d0139377ba5de4f170f63aee962b4587a7
- SSDEEP 98304:vP0l/h4tZNh7XExcawXP0l/h4tZNh7XExcaws:H0l/h4tFZ0l/h4tFa
- TLSH T1F7469E91754CC866E516907BA67438598038B4E7E3B11CCBFFC03D20666AED3A93E367
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral1/files/0x00050000000168c1-2.dat family_shodi behavioral1/files/0x0008000000024468-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 4324 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3552 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3940 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5048 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1640 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2132 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2716 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1060 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3472 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4260 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4116 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2684 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2080 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3256 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4372 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2940 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4892 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 616 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3284 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1732 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4756 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4432 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4772 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2256 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3248 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3276 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3968 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4972 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1152 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4160 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3292 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2804 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3832 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2468 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4640 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3520 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1444 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2984 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4292 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4104 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3612 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3460 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 204 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2704 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2836 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1940 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2412 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1376 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1776 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3644 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1292 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 924 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1464 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2548 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4240 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5036 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1496 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2008 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4180 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1304 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1936 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2812 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1324 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3956 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe - Drops file in Program Files directory 63 IoCs
description ioc Process File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaws.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaw.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaws.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javacpl.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaw.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5008 wrote to memory of 4324 5008 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe 85 PID 4324 wrote to memory of 3552 4324 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 86 PID 3552 wrote to memory of 3940 3552 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 87 PID 3940 wrote to memory of 5048 3940 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 88 PID 5048 wrote to memory of 1640 5048 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 89 PID 1640 wrote to memory of 2132 1640 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 90 PID 2132 wrote to memory of 2716 2132 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 91 PID 2716 wrote to memory of 1060 2716 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 92 PID 1060 wrote to memory of 3472 1060 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 93 PID 3472 wrote to memory of 4260 3472 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 94 PID 4260 wrote to memory of 4116 4260 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 95 PID 4116 wrote to memory of 2684 4116 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 96 PID 2684 wrote to memory of 2080 2684 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 97 PID 2080 wrote to memory of 3256 2080 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 98 PID 3256 wrote to memory of 4372 3256 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 99 PID 4372 wrote to memory of 2940 4372 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 100 PID 2940 wrote to memory of 4892 2940 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 101 PID 4892 wrote to memory of 616 4892 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 102 PID 616 wrote to memory of 3284 616 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 103 PID 3284 wrote to memory of 1732 3284 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 104 PID 1732 wrote to memory of 4756 1732 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 105 PID 4756 wrote to memory of 4432 4756 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 106 PID 4432 wrote to memory of 4772 4432 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 107 PID 4772 wrote to memory of 2256 4772 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 108 PID 2256 wrote to memory of 3248 2256 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 109 PID 3248 wrote to memory of 3276 3248 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 110 PID 3276 wrote to memory of 3968 3276 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 111 PID 3968 wrote to memory of 4972 3968 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 112 PID 4972 wrote to memory of 1152 4972 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 113 PID 1152 wrote to memory of 4160 1152 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 114 PID 4160 wrote to memory of 3292 4160 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 115 PID 3292 wrote to memory of 2804 3292 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 116 PID 2804 wrote to memory of 3832 2804 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 117 PID 3832 wrote to memory of 2468 3832 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 118 PID 2468 wrote to memory of 4640 2468 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 119 PID 4640 wrote to memory of 3520 4640 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 120 PID 3520 wrote to memory of 1444 3520 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 121 PID 1444 wrote to memory of 2984 1444 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 122 PID 2984 wrote to memory of 4292 2984 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 123 PID 4292 wrote to memory of 4104 4292 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 124 PID 4104 wrote to memory of 3612 4104 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 125 PID 3612 wrote to memory of 3460 3612 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 126 PID 3460 wrote to memory of 204 3460 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 127 PID 204 wrote to memory of 2704 204 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 128 PID 2704 wrote to memory of 2836 2704 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 129 PID 2836 wrote to memory of 1940 2836 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 130 PID 1940 wrote to memory of 2412 1940 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 131 PID 2412 wrote to memory of 1376 2412 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 132 PID 1376 wrote to memory of 1776 1376 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 133 PID 1776 wrote to memory of 3644 1776 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 134 PID 3644 wrote to memory of 1292 3644 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 135 PID 1292 wrote to memory of 924 1292 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 136 PID 924 wrote to memory of 1464 924 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 137 PID 1464 wrote to memory of 2548 1464 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 138 PID 2548 wrote to memory of 4240 2548 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 139 PID 4240 wrote to memory of 5036 4240 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 140 PID 5036 wrote to memory of 1496 5036 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 141 PID 1496 wrote to memory of 2008 1496 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 142 PID 2008 wrote to memory of 4180 2008 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 143 PID 4180 wrote to memory of 1304 4180 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 144 PID 1304 wrote to memory of 1936 1304 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 145 PID 1936 wrote to memory of 2812 1936 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 146 PID 2812 wrote to memory of 1324 2812 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 147 PID 1324 wrote to memory of 3956 1324 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa66⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa67⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa68⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa69⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa70⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa71⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa72⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa73⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa74⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa75⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa76⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa77⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa78⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa79⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa80⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa81⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa82⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa83⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa84⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa85⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa86⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa87⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa88⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa89⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa90⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa91⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa92⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa93⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa94⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa95⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa96⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa97⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa98⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa99⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa100⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa101⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa102⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa103⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa104⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa105⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa106⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa107⤵PID:5236
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa108⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa109⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa110⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa111⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa112⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa113⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa114⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa115⤵PID:5364
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa116⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa117⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa118⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa119⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa120⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa121⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa122⤵PID:5476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-