Analysis
- max time kernel
68s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/05/2026, 12:26
Behavioral task
behavioral1
Sample
2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
General
- Target 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe
- Size 4.7MB
- Sample260504-pl81baft7p
- SHA256 86b5d3a149e528dcbb178213d63f9cf4a4492252e61930eb7a35044d76bcda08
- MD5 4d6eae87266a1ff70534ddbaa2e1a338
- SHA1 bd9ad26bd35f33f2d353df54181710822bac6893
- SHA512 ec4889c6e7c60b93927eb6dd0069c74e2f817554ad49072fb16c4358680981c07a45cbbf77941adf38eecb6aad832459395f6022807de681bb6420eb0cebf75e
- SSDEEP 49152:xxgGhqFTTGT1mbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9ixgGhqFTTGT1mbXsPNI7:EPk1mbXsPN5kiQaHPk1mbXsPN5kiQao
- TLSH T167368D22B6458175D85180F16AB9AE7BD03CF938077E18C7A7C46E222575AD37B3AF03
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x001e00000002b18c-3.dat family_shodi behavioral2/files/0x001a00000002b40e-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 4936 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 1740 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 3160 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 4332 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 552 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 3728 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 4836 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 2228 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 5036 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 4296 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 1124 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 704 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 3712 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 4780 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 944 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 1284 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 3780 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 3892 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 4628 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 3964 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 4956 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 4960 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 868 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 3644 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 2036 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 1428 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 1572 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 1480 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 2656 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 976 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 2084 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 4324 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 1696 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 440 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 3004 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 3876 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 2348 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 3508 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 4140 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 3256 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 4552 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 3452 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 4428 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 3200 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 2672 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 4736 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 4376 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 4544 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 4460 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 3156 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 4164 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 432 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 480 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 4112 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 1348 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 1444 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 2748 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 128 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 760 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 2848 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 3020 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 2224 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 972 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 1560 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaws.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msotd.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTEM.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaws.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaw.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javacpl.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaw.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoasb.usa 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4952 wrote to memory of 4936 4952 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe 79 PID 4936 wrote to memory of 1740 4936 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 80 PID 1740 wrote to memory of 3160 1740 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 81 PID 3160 wrote to memory of 4332 3160 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 82 PID 4332 wrote to memory of 552 4332 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 83 PID 552 wrote to memory of 3728 552 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 84 PID 3728 wrote to memory of 4836 3728 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 85 PID 4836 wrote to memory of 2228 4836 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 86 PID 2228 wrote to memory of 5036 2228 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 87 PID 5036 wrote to memory of 4296 5036 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 88 PID 4296 wrote to memory of 1124 4296 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 89 PID 1124 wrote to memory of 704 1124 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 90 PID 704 wrote to memory of 3712 704 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 91 PID 3712 wrote to memory of 4780 3712 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 92 PID 4780 wrote to memory of 944 4780 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 93 PID 944 wrote to memory of 1284 944 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 94 PID 1284 wrote to memory of 3780 1284 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 95 PID 3780 wrote to memory of 3892 3780 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 96 PID 3892 wrote to memory of 4628 3892 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 97 PID 4628 wrote to memory of 3964 4628 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 98 PID 3964 wrote to memory of 4956 3964 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 99 PID 4956 wrote to memory of 4960 4956 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 100 PID 4960 wrote to memory of 868 4960 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 101 PID 868 wrote to memory of 3644 868 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 102 PID 3644 wrote to memory of 2036 3644 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 103 PID 2036 wrote to memory of 1428 2036 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 104 PID 1428 wrote to memory of 1572 1428 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 105 PID 1572 wrote to memory of 1480 1572 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 106 PID 1480 wrote to memory of 2656 1480 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 107 PID 2656 wrote to memory of 976 2656 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 108 PID 976 wrote to memory of 2084 976 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 109 PID 2084 wrote to memory of 4324 2084 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 110 PID 4324 wrote to memory of 1696 4324 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 111 PID 1696 wrote to memory of 440 1696 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 112 PID 440 wrote to memory of 3004 440 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 113 PID 3004 wrote to memory of 3876 3004 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 114 PID 3876 wrote to memory of 2348 3876 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 115 PID 2348 wrote to memory of 3508 2348 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 116 PID 3508 wrote to memory of 4140 3508 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 117 PID 4140 wrote to memory of 3256 4140 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 118 PID 3256 wrote to memory of 4552 3256 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 119 PID 4552 wrote to memory of 3452 4552 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 120 PID 3452 wrote to memory of 4428 3452 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 121 PID 4428 wrote to memory of 3200 4428 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 122 PID 3200 wrote to memory of 2672 3200 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 123 PID 2672 wrote to memory of 4736 2672 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 124 PID 4736 wrote to memory of 4376 4736 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 125 PID 4376 wrote to memory of 4544 4376 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 126 PID 4544 wrote to memory of 4460 4544 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 127 PID 4460 wrote to memory of 3156 4460 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 128 PID 3156 wrote to memory of 4164 3156 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 129 PID 4164 wrote to memory of 432 4164 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 130 PID 432 wrote to memory of 480 432 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 131 PID 480 wrote to memory of 4112 480 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 132 PID 4112 wrote to memory of 1348 4112 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 133 PID 1348 wrote to memory of 1444 1348 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 134 PID 1444 wrote to memory of 2748 1444 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 135 PID 2748 wrote to memory of 128 2748 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 136 PID 128 wrote to memory of 760 128 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 137 PID 760 wrote to memory of 2848 760 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 138 PID 2848 wrote to memory of 3020 2848 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 139 PID 3020 wrote to memory of 2224 3020 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 140 PID 2224 wrote to memory of 972 2224 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 141 PID 972 wrote to memory of 1560 972 2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:128 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa66⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa67⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa68⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa69⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa70⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa71⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa72⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa73⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa74⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa75⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa76⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa77⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa78⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa79⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa80⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa81⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa82⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa83⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa84⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa85⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa86⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa87⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa88⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa89⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa90⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa91⤵
- System Location Discovery: System Language Discovery
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa92⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa93⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa94⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa95⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa96⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa97⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa98⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa99⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa100⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa101⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa102⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa103⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa104⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa105⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa106⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa107⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa108⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa109⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa110⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa111⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa112⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa113⤵PID:5192
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa114⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa115⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa116⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa117⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa118⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa119⤵PID:5288
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa120⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa121⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-05-04_4d6eae87266a1ff70534ddbaa2e1a338_akira_amadey_cloudeye_elex_rhadamanthys.usa122⤵PID:5336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-