Analysis
- max time kernel
22s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/10/2026, 14:37
Behavioral task
behavioral1
Sample
2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe
Resource
win10v2004-20260911-en
7 signatures
150 seconds
General
- Target 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe
- Size 5.3MB
- Sample261020-ry7dcs1vfs
- SHA256 d7ebb37ea10afa0bd60f3baffdd3f33df31e538e31937a1a9f6b964b6708925d
- MD5 8463fb0e0a2c9145b836fe996d11af03
- SHA1 d1dc52da1a0085eb029d0b2ef6ca7b8f855082e2
- SHA512 5b92267274d12ad5e540477bcb0ad79eb8f7e946290ee06b7c9eb8b5be7dc685e03be44318b2352990f12248b234150cd1e650f5f4b50fc4e766852faf933238
- SSDEEP 98304:EU25/h4tZNh7XExcawrU25/h4tZNh7XExcawC:x25/h4tFO25/h4tFU
- TLSH T1E246AE91754CC866E516907B66B438598038B4E7E3B118CBFFC03D30666AED3AD3A367
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x00170000000115ae-3.dat family_shodi behavioral2/files/0x000c00000001c5c2-67.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 3560 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1392 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4376 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3524 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3792 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4952 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4388 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3192 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4900 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2580 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3412 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4656 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2020 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4580 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2460 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5068 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2216 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1308 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2532 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3952 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 360 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4592 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2716 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5912 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 352 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 240 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1116 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4508 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 704 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4436 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4624 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4488 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4452 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4884 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3608 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3844 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1508 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3352 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5824 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2808 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5916 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1932 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3008 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 6012 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2828 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4288 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4440 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5600 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4284 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1600 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5812 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1936 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2680 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2996 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3388 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4520 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1684 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 540 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5624 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3476 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5508 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1688 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4980 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3880 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4356 wrote to memory of 3560 4356 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe 90 PID 3560 wrote to memory of 1392 3560 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 91 PID 1392 wrote to memory of 4376 1392 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 92 PID 4376 wrote to memory of 3524 4376 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 93 PID 3524 wrote to memory of 3792 3524 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 94 PID 3792 wrote to memory of 4952 3792 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 95 PID 4952 wrote to memory of 4388 4952 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 96 PID 4388 wrote to memory of 3192 4388 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 97 PID 3192 wrote to memory of 4900 3192 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 98 PID 4900 wrote to memory of 2580 4900 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 99 PID 2580 wrote to memory of 3412 2580 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 100 PID 3412 wrote to memory of 4656 3412 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 101 PID 4656 wrote to memory of 2020 4656 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 102 PID 2020 wrote to memory of 4580 2020 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 103 PID 4580 wrote to memory of 2460 4580 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 104 PID 2460 wrote to memory of 5068 2460 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 105 PID 5068 wrote to memory of 2216 5068 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 106 PID 2216 wrote to memory of 1308 2216 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 107 PID 1308 wrote to memory of 2532 1308 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 108 PID 2532 wrote to memory of 3952 2532 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 109 PID 3952 wrote to memory of 360 3952 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 110 PID 360 wrote to memory of 4592 360 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 111 PID 4592 wrote to memory of 2716 4592 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 112 PID 2716 wrote to memory of 5912 2716 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 113 PID 5912 wrote to memory of 352 5912 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 114 PID 352 wrote to memory of 240 352 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 115 PID 240 wrote to memory of 1116 240 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 116 PID 1116 wrote to memory of 4508 1116 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 117 PID 4508 wrote to memory of 704 4508 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 118 PID 704 wrote to memory of 4436 704 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 119 PID 4436 wrote to memory of 4624 4436 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 120 PID 4624 wrote to memory of 4488 4624 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 121 PID 4488 wrote to memory of 4452 4488 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 122 PID 4452 wrote to memory of 4884 4452 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 123 PID 4884 wrote to memory of 3608 4884 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 124 PID 3608 wrote to memory of 3844 3608 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 125 PID 3844 wrote to memory of 1508 3844 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 126 PID 1508 wrote to memory of 3352 1508 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 127 PID 3352 wrote to memory of 5824 3352 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 128 PID 5824 wrote to memory of 2808 5824 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 129 PID 2808 wrote to memory of 5916 2808 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 130 PID 5916 wrote to memory of 1932 5916 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 131 PID 1932 wrote to memory of 3008 1932 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 132 PID 3008 wrote to memory of 6012 3008 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 133 PID 6012 wrote to memory of 2828 6012 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 134 PID 2828 wrote to memory of 4288 2828 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 135 PID 4288 wrote to memory of 4440 4288 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 136 PID 4440 wrote to memory of 5600 4440 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 137 PID 5600 wrote to memory of 4284 5600 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 138 PID 4284 wrote to memory of 1600 4284 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 139 PID 1600 wrote to memory of 5812 1600 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 140 PID 5812 wrote to memory of 1936 5812 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 141 PID 1936 wrote to memory of 2680 1936 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 142 PID 2680 wrote to memory of 2996 2680 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 143 PID 2996 wrote to memory of 3388 2996 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 144 PID 3388 wrote to memory of 4520 3388 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 145 PID 4520 wrote to memory of 1684 4520 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 146 PID 1684 wrote to memory of 540 1684 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 147 PID 540 wrote to memory of 5624 540 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 148 PID 5624 wrote to memory of 3476 5624 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 149 PID 3476 wrote to memory of 5508 3476 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 150 PID 5508 wrote to memory of 1688 5508 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 151 PID 1688 wrote to memory of 4980 1688 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 152 PID 4980 wrote to memory of 3880 4980 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa66⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa67⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa68⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa69⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa70⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa71⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa72⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa73⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa74⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa75⤵
- System Location Discovery: System Language Discovery
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa76⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa77⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa78⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa79⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa80⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa81⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa82⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa83⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa84⤵
- System Location Discovery: System Language Discovery
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa85⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa86⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa87⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa88⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa89⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa90⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa91⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa92⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa93⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa94⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa95⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa96⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa97⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa98⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa99⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa100⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa101⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa102⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa103⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa104⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa105⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa106⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa107⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa108⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa109⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa110⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa111⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa112⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa113⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa114⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa115⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa116⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa117⤵
- System Location Discovery: System Language Discovery
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa118⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa119⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa120⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa121⤵PID:6148
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa122⤵PID:6164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-