Analysis
- max time kernel
18s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 16:49
Behavioral task
behavioral1
Sample
2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
General
- Target 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.exe
- Size 8.8MB
- Sample260802-vbvb3aszdt
- SHA256 1742f114bb7c6920cc61ba66d98e8290df7e8f0b927d6ec9a53769a535852c01
- MD5 cbd7993414c73b5cdf35a1dcbc3ec9a5
- SHA1 ac3ec665aca850b32339911c8cee95fdf59b6210
- SHA512 4fdc3e87d73a6dc73fb10f812c6c53759ea2319668f9918c09d7f3444bb086e29f1b163138ae5edc803fc6f36b3bc9eebc349b9f6adee27efc0fc1b2c9e64b34
- SSDEEP 196608:cQDXl2S9+ULdNPtbuPZtQDXl2S9+ULdNPtbuPZw:cmV2SlLdNPt6RtmV2SlLdNPt6Rw
- TLSH T10D96CF23FB90407AD41F927389299636E5B2F82427389FDB13849A19FF656C37F36241
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000c00000001b8ae-3.dat family_shodi behavioral2/files/0x000d00000001c4d2-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 3128 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 5496 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 3388 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 1560 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2136 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4280 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 5616 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2320 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4936 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 3688 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2828 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 1884 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 6008 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 5584 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4200 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4120 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 5544 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2940 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 5016 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 1888 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 1824 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4296 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4872 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4564 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 3352 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 1064 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 3340 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 5692 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 3680 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2816 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 384 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 5188 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 1580 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4392 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 3052 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 5068 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 1148 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 6072 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2452 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 6084 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 5384 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 1868 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 5588 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 1076 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2324 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 5212 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2976 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 5688 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 5940 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 1880 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 5992 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4520 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4496 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4560 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2144 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4152 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 1284 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 5184 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 1160 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 3984 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 5972 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2068 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 2968 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 4188 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4728 wrote to memory of 3128 4728 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.exe 89 PID 3128 wrote to memory of 5496 3128 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 90 PID 5496 wrote to memory of 3388 5496 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 91 PID 3388 wrote to memory of 1560 3388 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 92 PID 1560 wrote to memory of 2136 1560 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 93 PID 2136 wrote to memory of 4280 2136 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 94 PID 4280 wrote to memory of 5616 4280 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 95 PID 5616 wrote to memory of 2320 5616 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 96 PID 2320 wrote to memory of 4936 2320 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 97 PID 4936 wrote to memory of 3688 4936 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 98 PID 3688 wrote to memory of 2828 3688 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 99 PID 2828 wrote to memory of 1884 2828 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 100 PID 1884 wrote to memory of 6008 1884 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 101 PID 6008 wrote to memory of 5584 6008 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 102 PID 5584 wrote to memory of 4200 5584 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 103 PID 4200 wrote to memory of 4120 4200 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 104 PID 4120 wrote to memory of 5544 4120 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 105 PID 5544 wrote to memory of 2940 5544 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 106 PID 2940 wrote to memory of 5016 2940 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 107 PID 5016 wrote to memory of 1888 5016 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 108 PID 1888 wrote to memory of 1824 1888 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 109 PID 1824 wrote to memory of 4296 1824 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 110 PID 4296 wrote to memory of 4872 4296 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 111 PID 4872 wrote to memory of 4564 4872 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 112 PID 4564 wrote to memory of 3352 4564 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 113 PID 3352 wrote to memory of 1064 3352 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 114 PID 1064 wrote to memory of 3340 1064 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 115 PID 3340 wrote to memory of 5692 3340 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 116 PID 5692 wrote to memory of 3680 5692 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 117 PID 3680 wrote to memory of 2816 3680 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 118 PID 2816 wrote to memory of 384 2816 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 119 PID 384 wrote to memory of 5188 384 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 120 PID 5188 wrote to memory of 1580 5188 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 121 PID 1580 wrote to memory of 4392 1580 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 122 PID 4392 wrote to memory of 3052 4392 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 123 PID 3052 wrote to memory of 5068 3052 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 124 PID 5068 wrote to memory of 1148 5068 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 125 PID 1148 wrote to memory of 6072 1148 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 126 PID 6072 wrote to memory of 2452 6072 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 127 PID 2452 wrote to memory of 6084 2452 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 128 PID 6084 wrote to memory of 5384 6084 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 129 PID 5384 wrote to memory of 1868 5384 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 130 PID 1868 wrote to memory of 5588 1868 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 131 PID 5588 wrote to memory of 1076 5588 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 132 PID 1076 wrote to memory of 2324 1076 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 133 PID 2324 wrote to memory of 5212 2324 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 134 PID 5212 wrote to memory of 2976 5212 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 135 PID 2976 wrote to memory of 5688 2976 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 136 PID 5688 wrote to memory of 5940 5688 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 137 PID 5940 wrote to memory of 1880 5940 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 138 PID 1880 wrote to memory of 5992 1880 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 139 PID 5992 wrote to memory of 4520 5992 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 140 PID 4520 wrote to memory of 4496 4520 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 141 PID 4496 wrote to memory of 4560 4496 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 142 PID 4560 wrote to memory of 2144 4560 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 143 PID 2144 wrote to memory of 4152 2144 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 144 PID 4152 wrote to memory of 1284 4152 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 145 PID 1284 wrote to memory of 5184 1284 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 146 PID 5184 wrote to memory of 1160 5184 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 147 PID 1160 wrote to memory of 3984 1160 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 148 PID 3984 wrote to memory of 5972 3984 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 149 PID 5972 wrote to memory of 2068 5972 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 150 PID 2068 wrote to memory of 2968 2068 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 151 PID 2968 wrote to memory of 4188 2968 2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa65⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa66⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa67⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa68⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa69⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa70⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa71⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa72⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa73⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa74⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa75⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa76⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa77⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa78⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa79⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa80⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa81⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa82⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa83⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa84⤵
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa85⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa86⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa87⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa88⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa89⤵
- System Location Discovery: System Language Discovery
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa90⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa91⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa92⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa93⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa94⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa95⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa96⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa97⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa98⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa99⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa100⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa101⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa102⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa103⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa104⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa105⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa106⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa107⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa108⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa109⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa110⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa111⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa112⤵
- System Location Discovery: System Language Discovery
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa113⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa114⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa115⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa116⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa117⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa118⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa119⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa120⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa121⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-08-02_cbd7993414c73b5cdf35a1dcbc3ec9a5_akira_amadey_cloudeye_cobalt-strike_elex_luca-stealer_njrat_rhadamanthys_vidar.usa122⤵PID:5920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-