Analysis
- max time kernel
16s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 21:31
Behavioral task
behavioral1
Sample
2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.exe
- Size 3.6MB
- Sample260805-1c6dlssta1
- SHA256 4b2c42114ca03fd26cd461f6172eae39c1c1388a1307d9475d67b24f1936e330
- MD5 2fd54e57d7f6d83f92a2eb39c3d51dac
- SHA1 d3ed95f759102d44dbdf8d5e5452b177b8638c64
- SHA512 36cf82e1c340feb517d30b569b2762c6b14aed814b9d9a839ceb964c33e0d6667e8bfae7ab6b1ad40913a37a8106702db58715e7e36c7d0c502b2f7fd51cebd3
- SSDEEP 49152:CwxgGhqFTTQAK3ckwq/qo7wxgGhqFTTQAK3ckwq/qou:CnP23ckB/qo7nP23ckB/qou
- TLSH T1BB067C22F6C3837CE45580B556EDAFB6D40CBC2A076454C39BE4BD236D623C21E3A759
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000e00000001b1d0-3.dat family_shodi behavioral2/files/0x000d00000001c4c3-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 4360 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 4696 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 2584 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 5216 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 756 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 1768 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 5472 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 4756 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 4472 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 2932 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 4808 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 4232 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 5460 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 5504 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 1492 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 4116 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 5068 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 2068 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 124 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 2824 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 3672 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 2024 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 4572 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 2396 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 5496 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 4092 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 4636 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 2476 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 5108 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 4080 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 4544 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 3196 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 2196 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 916 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 5792 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 896 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 1180 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 5812 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 5984 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 3348 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 1064 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 828 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 4816 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 5856 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 5904 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 3700 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 3232 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 4776 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 968 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 1328 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 2660 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 1140 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 2552 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 4500 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 2988 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 628 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 4648 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 1428 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 5104 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 6048 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 956 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 6020 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 5716 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 4744 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4412 wrote to memory of 4360 4412 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.exe 89 PID 4360 wrote to memory of 4696 4360 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 90 PID 4696 wrote to memory of 2584 4696 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 91 PID 2584 wrote to memory of 5216 2584 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 92 PID 5216 wrote to memory of 756 5216 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 93 PID 756 wrote to memory of 1768 756 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 94 PID 1768 wrote to memory of 5472 1768 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 95 PID 5472 wrote to memory of 4756 5472 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 96 PID 4756 wrote to memory of 4472 4756 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 97 PID 4472 wrote to memory of 2932 4472 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 98 PID 2932 wrote to memory of 4808 2932 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 99 PID 4808 wrote to memory of 4232 4808 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 100 PID 4232 wrote to memory of 5460 4232 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 101 PID 5460 wrote to memory of 5504 5460 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 102 PID 5504 wrote to memory of 1492 5504 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 103 PID 1492 wrote to memory of 4116 1492 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 104 PID 4116 wrote to memory of 5068 4116 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 105 PID 5068 wrote to memory of 2068 5068 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 106 PID 2068 wrote to memory of 124 2068 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 107 PID 124 wrote to memory of 2824 124 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 108 PID 2824 wrote to memory of 3672 2824 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 109 PID 3672 wrote to memory of 2024 3672 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 110 PID 2024 wrote to memory of 4572 2024 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 111 PID 4572 wrote to memory of 2396 4572 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 112 PID 2396 wrote to memory of 5496 2396 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 113 PID 5496 wrote to memory of 4092 5496 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 114 PID 4092 wrote to memory of 4636 4092 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 115 PID 4636 wrote to memory of 2476 4636 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 116 PID 2476 wrote to memory of 5108 2476 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 117 PID 5108 wrote to memory of 4080 5108 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 118 PID 4080 wrote to memory of 4544 4080 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 119 PID 4544 wrote to memory of 3196 4544 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 120 PID 3196 wrote to memory of 2196 3196 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 121 PID 2196 wrote to memory of 916 2196 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 122 PID 916 wrote to memory of 5792 916 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 123 PID 5792 wrote to memory of 896 5792 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 124 PID 896 wrote to memory of 1180 896 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 125 PID 1180 wrote to memory of 5812 1180 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 126 PID 5812 wrote to memory of 5984 5812 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 127 PID 5984 wrote to memory of 3348 5984 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 128 PID 3348 wrote to memory of 1064 3348 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 129 PID 1064 wrote to memory of 828 1064 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 130 PID 828 wrote to memory of 4816 828 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 131 PID 4816 wrote to memory of 5856 4816 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 132 PID 5856 wrote to memory of 5904 5856 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 133 PID 5904 wrote to memory of 3700 5904 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 134 PID 3700 wrote to memory of 3232 3700 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 135 PID 3232 wrote to memory of 4776 3232 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 136 PID 4776 wrote to memory of 968 4776 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 137 PID 968 wrote to memory of 1328 968 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 138 PID 1328 wrote to memory of 2660 1328 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 139 PID 2660 wrote to memory of 1140 2660 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 140 PID 1140 wrote to memory of 2552 1140 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 141 PID 2552 wrote to memory of 4500 2552 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 142 PID 4500 wrote to memory of 2988 4500 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 143 PID 2988 wrote to memory of 628 2988 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 144 PID 628 wrote to memory of 4648 628 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 145 PID 4648 wrote to memory of 1428 4648 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 146 PID 1428 wrote to memory of 5104 1428 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 147 PID 5104 wrote to memory of 6048 5104 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 148 PID 6048 wrote to memory of 956 6048 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 149 PID 956 wrote to memory of 6020 956 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 150 PID 6020 wrote to memory of 5716 6020 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 151 PID 5716 wrote to memory of 4744 5716 2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa66⤵
- System Location Discovery: System Language Discovery
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa67⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa68⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa69⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa70⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa71⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa72⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa73⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa74⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa75⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa76⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa77⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa78⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa79⤵PID:5192
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa80⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa81⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa82⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa83⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa84⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa85⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa86⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa87⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa88⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa89⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa90⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa91⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa92⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa93⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa94⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa95⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa96⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa97⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa98⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa99⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa100⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa101⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa102⤵
- System Location Discovery: System Language Discovery
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa103⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa104⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa105⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa106⤵
- System Location Discovery: System Language Discovery
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa107⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa108⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa109⤵PID:5588
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa110⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa111⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa112⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa113⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa114⤵
- System Location Discovery: System Language Discovery
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa115⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa116⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa117⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa118⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa119⤵PID:5604
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa120⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa121⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-05_2fd54e57d7f6d83f92a2eb39c3d51dac_akira_cloudeye_elex_remcos_rhadamanthys.usa122⤵PID:4112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-