Analysis
- max time kernel
60s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/07/2026, 01:40
Behavioral task
behavioral1
Sample
2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe
- Size 1.3MB
- Sample260720-b3vmcsby4j
- SHA256 508d735fdf54fb12ba8b0cfdb0fd4b30f59ad6e18e128736016bc5b5529daa12
- MD5 321a819369306e67f49853ab737b8cab
- SHA1 558ded288f2ebf84795366f5d99c6a24a9b0bb31
- SHA512 26f34647aa42635d280d285e36f98ca8052b83d74c41b355416d62a2f2e5f70fb62405f64e2f3572ce39081667a9a316192edac8b3c46ff39be32561c5a334e4
- SSDEEP 24576:Ixal9vGhqF3DTGTjkxal9vGhqF3DTGTjt:IxgGhqFTTGTAxgGhqFTTGTJ
- TLSH T14F556B13F65550B9D4AAC138871B9636BB72BC4A07316EDB23807B253E76BE06B3D704
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral1/files/0x000b0000000242ff-2.dat family_shodi behavioral1/files/0x000300000001e6d5-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 2188 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 4924 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 2528 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 4260 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 784 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 4504 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 4184 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 2120 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 1556 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 4160 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 4596 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 1280 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 3520 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 1764 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 3844 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 5012 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 4292 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 2872 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 4428 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 3988 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 1072 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 3904 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 3524 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 4884 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 3484 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 3304 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 2352 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 2460 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 1796 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 1944 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 2716 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 228 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 2800 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 1400 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 4800 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 3336 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 3348 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 2968 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 2620 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 4876 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 4332 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 4708 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 1836 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 3944 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 2364 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 2200 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 3872 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 4052 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 3960 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 4904 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 4232 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 4972 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 4112 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 548 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 3928 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 1728 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 3552 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 2664 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 5036 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 1508 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 376 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 1888 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 1860 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 3180 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaws.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaw.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CNFNOT32.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoasb.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msotd.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSQRY32.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTEM.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaws.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoev.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoia.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.usa 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4632 wrote to memory of 2188 4632 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe 87 PID 2188 wrote to memory of 4924 2188 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 88 PID 4924 wrote to memory of 2528 4924 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 89 PID 2528 wrote to memory of 4260 2528 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 90 PID 4260 wrote to memory of 784 4260 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 91 PID 784 wrote to memory of 4504 784 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 92 PID 4504 wrote to memory of 4184 4504 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 93 PID 4184 wrote to memory of 2120 4184 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 94 PID 2120 wrote to memory of 1556 2120 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 95 PID 1556 wrote to memory of 4160 1556 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 96 PID 4160 wrote to memory of 4596 4160 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 97 PID 4596 wrote to memory of 1280 4596 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 98 PID 1280 wrote to memory of 3520 1280 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 99 PID 3520 wrote to memory of 1764 3520 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 100 PID 1764 wrote to memory of 3844 1764 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 101 PID 3844 wrote to memory of 5012 3844 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 102 PID 5012 wrote to memory of 4292 5012 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 103 PID 4292 wrote to memory of 2872 4292 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 104 PID 2872 wrote to memory of 4428 2872 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 105 PID 4428 wrote to memory of 3988 4428 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 106 PID 3988 wrote to memory of 1072 3988 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 107 PID 1072 wrote to memory of 3904 1072 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 108 PID 3904 wrote to memory of 3524 3904 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 109 PID 3524 wrote to memory of 4884 3524 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 110 PID 4884 wrote to memory of 3484 4884 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 111 PID 3484 wrote to memory of 3304 3484 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 112 PID 3304 wrote to memory of 2352 3304 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 113 PID 2352 wrote to memory of 2460 2352 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 114 PID 2460 wrote to memory of 1796 2460 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 115 PID 1796 wrote to memory of 1944 1796 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 116 PID 1944 wrote to memory of 2716 1944 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 117 PID 2716 wrote to memory of 228 2716 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 118 PID 228 wrote to memory of 2800 228 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 119 PID 2800 wrote to memory of 1400 2800 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 120 PID 1400 wrote to memory of 4800 1400 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 121 PID 4800 wrote to memory of 3336 4800 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 122 PID 3336 wrote to memory of 3348 3336 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 123 PID 3348 wrote to memory of 2968 3348 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 124 PID 2968 wrote to memory of 2620 2968 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 125 PID 2620 wrote to memory of 4876 2620 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 126 PID 4876 wrote to memory of 4332 4876 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 127 PID 4332 wrote to memory of 4708 4332 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 128 PID 4708 wrote to memory of 1836 4708 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 129 PID 1836 wrote to memory of 3944 1836 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 130 PID 3944 wrote to memory of 2364 3944 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 131 PID 2364 wrote to memory of 2200 2364 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 132 PID 2200 wrote to memory of 3872 2200 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 133 PID 3872 wrote to memory of 4052 3872 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 134 PID 4052 wrote to memory of 3960 4052 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 135 PID 3960 wrote to memory of 4904 3960 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 136 PID 4904 wrote to memory of 4232 4904 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 137 PID 4232 wrote to memory of 4972 4232 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 138 PID 4972 wrote to memory of 4112 4972 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 139 PID 4112 wrote to memory of 548 4112 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 140 PID 548 wrote to memory of 3928 548 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 141 PID 3928 wrote to memory of 1728 3928 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 142 PID 1728 wrote to memory of 3552 1728 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 143 PID 3552 wrote to memory of 2664 3552 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 144 PID 2664 wrote to memory of 5036 2664 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 145 PID 5036 wrote to memory of 1508 5036 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 146 PID 1508 wrote to memory of 376 1508 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 147 PID 376 wrote to memory of 1888 376 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 148 PID 1888 wrote to memory of 1860 1888 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 149 PID 1860 wrote to memory of 3180 1860 2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa66⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa67⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa68⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa69⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa70⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa71⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa72⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa73⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa74⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa75⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa76⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa77⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa78⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa79⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa80⤵
- System Location Discovery: System Language Discovery
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa81⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa82⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa83⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa84⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa85⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa86⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa87⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa88⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa89⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa90⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa91⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa92⤵
- System Location Discovery: System Language Discovery
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa93⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa94⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa95⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa96⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa97⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa98⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa99⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa100⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa101⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa102⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa103⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa104⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa105⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa106⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa107⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa108⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa109⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa110⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa111⤵PID:5500
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa112⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa113⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa114⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa115⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa116⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa117⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa118⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa119⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa120⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa121⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-19_321a819369306e67f49853ab737b8cab_akira_cloudeye_elex_rhadamanthys.usa122⤵PID:5676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-