Analysis
- max time kernel
27s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 16:49
Behavioral task
behavioral1
Sample
2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
General
- Target 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.exe
- Size 8.8MB
- Sample260802-vbvb3aszdt
- SHA256 1742f114bb7c6920cc61ba66d98e8290df7e8f0b927d6ec9a53769a535852c01
- MD5 cbd7993414c73b5cdf35a1dcbc3ec9a5
- SHA1 ac3ec665aca850b32339911c8cee95fdf59b6210
- SHA512 4fdc3e87d73a6dc73fb10f812c6c53759ea2319668f9918c09d7f3444bb086e29f1b163138ae5edc803fc6f36b3bc9eebc349b9f6adee27efc0fc1b2c9e64b34
- SSDEEP 196608:cQDXl2S9+ULdNPtbuPZtQDXl2S9+ULdNPtbuPZw:cmV2SlLdNPt6RtmV2SlLdNPt6Rw
- TLSH T10D96CF23FB90407AD41F927389299636E5B2F82427389FDB13849A19FF656C37F36241
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral1/files/0x00160000000242b3-4.dat family_shodi behavioral1/files/0x00080000000243fd-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 4508 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 3032 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 1784 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4500 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 372 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 1800 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4696 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4720 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4184 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 3532 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4452 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4724 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2228 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4344 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 5004 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2080 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2128 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2116 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2400 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 3364 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4784 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4708 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4356 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 3268 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 368 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4608 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2816 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 696 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 3848 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4872 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 3124 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2912 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2364 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 1720 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4932 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4492 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 1056 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 3308 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 3804 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4624 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 908 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4180 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4472 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2292 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4576 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 1384 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 1768 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 5100 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 3416 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4936 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 3056 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 212 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4572 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4536 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 3436 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 3852 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 5040 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2980 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 872 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4408 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 436 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4944 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4704 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2392 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3512 wrote to memory of 4508 3512 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.exe 84 PID 4508 wrote to memory of 3032 4508 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 85 PID 3032 wrote to memory of 1784 3032 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 86 PID 1784 wrote to memory of 4500 1784 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 87 PID 4500 wrote to memory of 372 4500 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 88 PID 372 wrote to memory of 1800 372 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 89 PID 1800 wrote to memory of 4696 1800 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 90 PID 4696 wrote to memory of 4720 4696 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 91 PID 4720 wrote to memory of 4184 4720 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 92 PID 4184 wrote to memory of 3532 4184 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 93 PID 3532 wrote to memory of 4452 3532 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 94 PID 4452 wrote to memory of 4724 4452 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 95 PID 4724 wrote to memory of 2228 4724 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 96 PID 2228 wrote to memory of 4344 2228 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 97 PID 4344 wrote to memory of 5004 4344 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 98 PID 5004 wrote to memory of 2080 5004 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 99 PID 2080 wrote to memory of 2128 2080 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 100 PID 2128 wrote to memory of 2116 2128 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 101 PID 2116 wrote to memory of 2400 2116 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 102 PID 2400 wrote to memory of 3364 2400 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 103 PID 3364 wrote to memory of 4784 3364 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 104 PID 4784 wrote to memory of 4708 4784 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 105 PID 4708 wrote to memory of 4356 4708 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 106 PID 4356 wrote to memory of 3268 4356 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 107 PID 3268 wrote to memory of 368 3268 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 108 PID 368 wrote to memory of 4608 368 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 109 PID 4608 wrote to memory of 2816 4608 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 110 PID 2816 wrote to memory of 696 2816 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 111 PID 696 wrote to memory of 3848 696 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 112 PID 3848 wrote to memory of 4872 3848 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 113 PID 4872 wrote to memory of 3124 4872 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 114 PID 3124 wrote to memory of 2912 3124 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 115 PID 2912 wrote to memory of 2364 2912 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 116 PID 2364 wrote to memory of 1720 2364 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 117 PID 1720 wrote to memory of 4932 1720 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 118 PID 4932 wrote to memory of 4492 4932 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 119 PID 4492 wrote to memory of 1056 4492 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 120 PID 1056 wrote to memory of 3308 1056 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 121 PID 3308 wrote to memory of 3804 3308 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 122 PID 3804 wrote to memory of 4624 3804 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 123 PID 4624 wrote to memory of 908 4624 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 124 PID 908 wrote to memory of 4180 908 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 125 PID 4180 wrote to memory of 4472 4180 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 126 PID 4472 wrote to memory of 2292 4472 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 127 PID 2292 wrote to memory of 4576 2292 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 128 PID 4576 wrote to memory of 1384 4576 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 129 PID 1384 wrote to memory of 1768 1384 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 130 PID 1768 wrote to memory of 5100 1768 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 131 PID 5100 wrote to memory of 3416 5100 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 132 PID 3416 wrote to memory of 4936 3416 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 133 PID 4936 wrote to memory of 3056 4936 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 134 PID 3056 wrote to memory of 212 3056 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 135 PID 212 wrote to memory of 4572 212 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 136 PID 4572 wrote to memory of 4536 4572 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 137 PID 4536 wrote to memory of 3436 4536 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 138 PID 3436 wrote to memory of 3852 3436 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 139 PID 3852 wrote to memory of 5040 3852 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 140 PID 5040 wrote to memory of 2980 5040 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 141 PID 2980 wrote to memory of 872 2980 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 142 PID 872 wrote to memory of 4408 872 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 143 PID 4408 wrote to memory of 436 4408 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 144 PID 436 wrote to memory of 4944 436 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 145 PID 4944 wrote to memory of 4704 4944 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 146 PID 4704 wrote to memory of 2392 4704 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa65⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa66⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa67⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa68⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa69⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa70⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa71⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa72⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa73⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa74⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa75⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa76⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa77⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa78⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa79⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa80⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa81⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa82⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa83⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa84⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa85⤵
- System Location Discovery: System Language Discovery
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa86⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa87⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa88⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa89⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa90⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa91⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa92⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa93⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa94⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa95⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa96⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa97⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa98⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa99⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa100⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa101⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa102⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa103⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa104⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa105⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa106⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa107⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa108⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa109⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa110⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa111⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa112⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa113⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa114⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa115⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa116⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa117⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa118⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa119⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa120⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa121⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa122⤵PID:5452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-