Analysis
- max time kernel
31s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 00:41
Behavioral task
behavioral1
Sample
2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe
- Size 5.5MB
- Sample260808-a18krswfpb
- SHA256 50b213ca00cb5fd2b4b31ac1c71a5daae77084c319081b184853125ae73304d6
- MD5 c2f26d74464ca7130f33f3ef964e6c23
- SHA1 eeb323c3ca964637611dd8cd4ad8e26d7dad8c86
- SHA512 24a02a3457d70ba00a9930d874893656ea8ffa34d2c847d82a7be41e06f80a2a7a9edd407d3249c86c98efea74d7d9d0139377ba5de4f170f63aee962b4587a7
- SSDEEP 98304:vP0l/h4tZNh7XExcawXP0l/h4tZNh7XExcaws:H0l/h4tFZ0l/h4tFa
- TLSH T1F7469E91754CC866E516907BA67438598038B4E7E3B11CCBFFC03D20666AED3A93E367
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x0009000000019cc1-3.dat family_shodi behavioral2/files/0x000d00000001c5e0-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 4852 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4576 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5508 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4204 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1116 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3260 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4076 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2564 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3560 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4588 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4112 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2896 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5840 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3912 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1276 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4236 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 364 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4140 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5040 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1144 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5800 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3288 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1272 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5180 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5708 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1328 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2328 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3084 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5008 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1956 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1396 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2416 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1252 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2784 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1948 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5664 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1600 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5812 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4084 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3336 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4148 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2388 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1692 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 788 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3256 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 8 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4684 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4844 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2452 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4900 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4428 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3532 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2736 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 720 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2612 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5596 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2080 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3096 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 760 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5724 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4992 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4180 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2096 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2188 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5808 wrote to memory of 4852 5808 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe 89 PID 4852 wrote to memory of 4576 4852 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 90 PID 4576 wrote to memory of 5508 4576 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 91 PID 5508 wrote to memory of 4204 5508 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 92 PID 4204 wrote to memory of 1116 4204 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 93 PID 1116 wrote to memory of 3260 1116 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 94 PID 3260 wrote to memory of 4076 3260 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 95 PID 4076 wrote to memory of 2564 4076 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 96 PID 2564 wrote to memory of 3560 2564 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 97 PID 3560 wrote to memory of 4588 3560 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 98 PID 4588 wrote to memory of 4112 4588 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 99 PID 4112 wrote to memory of 2896 4112 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 100 PID 2896 wrote to memory of 5840 2896 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 101 PID 5840 wrote to memory of 3912 5840 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 102 PID 3912 wrote to memory of 1276 3912 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 103 PID 1276 wrote to memory of 4236 1276 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 104 PID 4236 wrote to memory of 364 4236 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 105 PID 364 wrote to memory of 4140 364 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 106 PID 4140 wrote to memory of 5040 4140 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 107 PID 5040 wrote to memory of 1144 5040 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 108 PID 1144 wrote to memory of 5800 1144 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 109 PID 5800 wrote to memory of 3288 5800 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 110 PID 3288 wrote to memory of 1272 3288 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 111 PID 1272 wrote to memory of 5180 1272 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 112 PID 5180 wrote to memory of 5708 5180 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 113 PID 5708 wrote to memory of 1328 5708 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 114 PID 1328 wrote to memory of 2328 1328 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 115 PID 2328 wrote to memory of 3084 2328 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 116 PID 3084 wrote to memory of 5008 3084 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 117 PID 5008 wrote to memory of 1956 5008 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 118 PID 1956 wrote to memory of 1396 1956 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 119 PID 1396 wrote to memory of 2416 1396 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 120 PID 2416 wrote to memory of 1252 2416 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 121 PID 1252 wrote to memory of 2784 1252 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 122 PID 2784 wrote to memory of 1948 2784 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 123 PID 1948 wrote to memory of 5664 1948 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 124 PID 5664 wrote to memory of 1600 5664 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 125 PID 1600 wrote to memory of 5812 1600 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 126 PID 5812 wrote to memory of 4084 5812 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 127 PID 4084 wrote to memory of 3336 4084 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 128 PID 3336 wrote to memory of 4148 3336 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 129 PID 4148 wrote to memory of 2388 4148 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 130 PID 2388 wrote to memory of 1692 2388 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 131 PID 1692 wrote to memory of 788 1692 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 132 PID 788 wrote to memory of 3256 788 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 133 PID 3256 wrote to memory of 8 3256 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 134 PID 8 wrote to memory of 4684 8 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 135 PID 4684 wrote to memory of 4844 4684 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 136 PID 4844 wrote to memory of 2452 4844 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 137 PID 2452 wrote to memory of 4900 2452 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 138 PID 4900 wrote to memory of 4428 4900 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 139 PID 4428 wrote to memory of 3532 4428 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 140 PID 3532 wrote to memory of 2736 3532 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 141 PID 2736 wrote to memory of 720 2736 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 142 PID 720 wrote to memory of 2612 720 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 143 PID 2612 wrote to memory of 5596 2612 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 144 PID 5596 wrote to memory of 2080 5596 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 145 PID 2080 wrote to memory of 3096 2080 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 146 PID 3096 wrote to memory of 760 3096 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 147 PID 760 wrote to memory of 5724 760 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 148 PID 5724 wrote to memory of 4992 5724 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 149 PID 4992 wrote to memory of 4180 4992 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 150 PID 4180 wrote to memory of 2096 4180 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 151 PID 2096 wrote to memory of 2188 2096 2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa66⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa67⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa68⤵
- System Location Discovery: System Language Discovery
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa69⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa70⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa71⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa72⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa73⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa74⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa75⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa76⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa77⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa78⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa79⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa80⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa81⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa82⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa83⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa84⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa85⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa86⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa87⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa88⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa89⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa90⤵PID:248
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa91⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa92⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa93⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa94⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa95⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa96⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa97⤵
- System Location Discovery: System Language Discovery
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa98⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa99⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa100⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa101⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa102⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa103⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa104⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa105⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa106⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa107⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa108⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa109⤵PID:260
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa110⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa111⤵
- System Location Discovery: System Language Discovery
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa112⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa113⤵
- System Location Discovery: System Language Discovery
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa114⤵PID:6148
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa115⤵PID:6164
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa116⤵PID:6180
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa117⤵PID:6196
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa118⤵
- System Location Discovery: System Language Discovery
PID:6212 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa119⤵PID:6228
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa120⤵PID:6244
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa121⤵PID:6260
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-07_c2f26d74464ca7130f33f3ef964e6c23_akira_cloudeye_elex_luca-stealer_njrat_remcos_rhadamanthys.usa122⤵PID:6276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-