Analysis
- max time kernel
20s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 02:49
Behavioral task
behavioral1
Sample
2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.exe
- Size 3.6MB
- Sample260804-da1c9aeq6t
- SHA256 5c6c0b35567c07151aaf1624c82e0fbfe73ede0c470f1228ea733616728fdc60
- MD5 6d65fa05c52fc481a1b53cab90bff6f6
- SHA1 6912dbe63c03670afae02724e09c4a52bb663e2f
- SHA512 4015aaefaf5b3f86852aaedbccf9d02044c781843e924f276f5ecb423bbaa89497756c046f684b7f5805e494f96c0aa67d95cc6b91d8d650a939183c1c937199
- SSDEEP 49152:exgGhqFTTN+Cq9i04OoxgGhqFTTN+Cq9i04OD:JPoi04OPPoi04OD
- TLSH T100068D03B9B9C17BD196C1308F5EA621F5B1B8590F3169DB27C06A2D2E76AD0A33D71C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000800000001b884-3.dat family_shodi behavioral2/files/0x000d00000001c4e5-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 4288 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 5384 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 2364 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 4676 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 1224 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 6092 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 4308 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 5844 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 5608 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 1512 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 580 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 2900 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 2056 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 1440 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 4512 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 4548 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 244 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 4888 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 2536 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 1412 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 4348 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 4312 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 684 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 1220 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 2260 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 2468 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 1036 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 860 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 5180 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 5768 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 3260 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 5872 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 4820 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 3668 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 3328 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 940 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 5148 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 4356 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 4584 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 2976 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 3832 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 2968 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 3612 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 1392 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 2988 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 1808 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 1560 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 2864 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 5564 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 5344 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 4884 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 4424 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 2828 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 2024 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 2080 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 4316 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 4744 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 4496 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 2412 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 3844 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 3456 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 6072 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 4980 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 1604 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5936 wrote to memory of 4288 5936 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.exe 89 PID 4288 wrote to memory of 5384 4288 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 90 PID 5384 wrote to memory of 2364 5384 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 91 PID 2364 wrote to memory of 4676 2364 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 92 PID 4676 wrote to memory of 1224 4676 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 93 PID 1224 wrote to memory of 6092 1224 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 94 PID 6092 wrote to memory of 4308 6092 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 95 PID 4308 wrote to memory of 5844 4308 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 96 PID 5844 wrote to memory of 5608 5844 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 97 PID 5608 wrote to memory of 1512 5608 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 98 PID 1512 wrote to memory of 580 1512 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 99 PID 580 wrote to memory of 2900 580 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 100 PID 2900 wrote to memory of 2056 2900 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 101 PID 2056 wrote to memory of 1440 2056 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 102 PID 1440 wrote to memory of 4512 1440 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 103 PID 4512 wrote to memory of 4548 4512 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 104 PID 4548 wrote to memory of 244 4548 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 105 PID 244 wrote to memory of 4888 244 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 106 PID 4888 wrote to memory of 2536 4888 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 107 PID 2536 wrote to memory of 1412 2536 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 108 PID 1412 wrote to memory of 4348 1412 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 109 PID 4348 wrote to memory of 4312 4348 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 110 PID 4312 wrote to memory of 684 4312 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 111 PID 684 wrote to memory of 1220 684 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 112 PID 1220 wrote to memory of 2260 1220 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 113 PID 2260 wrote to memory of 2468 2260 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 114 PID 2468 wrote to memory of 1036 2468 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 115 PID 1036 wrote to memory of 860 1036 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 116 PID 860 wrote to memory of 5180 860 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 117 PID 5180 wrote to memory of 5768 5180 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 118 PID 5768 wrote to memory of 3260 5768 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 119 PID 3260 wrote to memory of 5872 3260 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 120 PID 5872 wrote to memory of 4820 5872 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 121 PID 4820 wrote to memory of 3668 4820 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 122 PID 3668 wrote to memory of 3328 3668 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 123 PID 3328 wrote to memory of 940 3328 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 124 PID 940 wrote to memory of 5148 940 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 125 PID 5148 wrote to memory of 4356 5148 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 126 PID 4356 wrote to memory of 4584 4356 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 127 PID 4584 wrote to memory of 2976 4584 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 128 PID 2976 wrote to memory of 3832 2976 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 129 PID 3832 wrote to memory of 2968 3832 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 130 PID 2968 wrote to memory of 3612 2968 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 131 PID 3612 wrote to memory of 1392 3612 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 132 PID 1392 wrote to memory of 2988 1392 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 133 PID 2988 wrote to memory of 1808 2988 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 134 PID 1808 wrote to memory of 1560 1808 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 135 PID 1560 wrote to memory of 2864 1560 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 136 PID 2864 wrote to memory of 5564 2864 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 137 PID 5564 wrote to memory of 5344 5564 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 138 PID 5344 wrote to memory of 4884 5344 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 139 PID 4884 wrote to memory of 4424 4884 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 140 PID 4424 wrote to memory of 2828 4424 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 141 PID 2828 wrote to memory of 2024 2828 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 142 PID 2024 wrote to memory of 2080 2024 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 143 PID 2080 wrote to memory of 4316 2080 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 144 PID 4316 wrote to memory of 4744 4316 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 145 PID 4744 wrote to memory of 4496 4744 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 146 PID 4496 wrote to memory of 2412 4496 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 147 PID 2412 wrote to memory of 3844 2412 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 148 PID 3844 wrote to memory of 3456 3844 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 149 PID 3456 wrote to memory of 6072 3456 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 150 PID 6072 wrote to memory of 4980 6072 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 151 PID 4980 wrote to memory of 1604 4980 2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa65⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa66⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa67⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa68⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa69⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa70⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa71⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa72⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa73⤵
- System Location Discovery: System Language Discovery
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa74⤵
- System Location Discovery: System Language Discovery
PID:432 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa75⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa76⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa77⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa78⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa79⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa80⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa81⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa82⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa83⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa84⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa85⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa86⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa87⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa88⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa89⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa90⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa91⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa92⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa93⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa94⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa95⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa96⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa97⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa98⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa99⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa100⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa101⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa102⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa103⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa104⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa105⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa106⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa107⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa108⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa109⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa110⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa111⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa112⤵PID:5248
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa113⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa114⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa115⤵
- System Location Discovery: System Language Discovery
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa116⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa117⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa118⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa119⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa120⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa121⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usaC:\Users\Admin\AppData\Local\Temp\2026-08-03_6d65fa05c52fc481a1b53cab90bff6f6_akira_cloudeye_elex_rhadamanthys_wannacry.usa122⤵PID:3340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-