Analysis
- max time kernel
43s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 17:46
Behavioral task
behavioral1
Sample
2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe
- Size 4.1MB
- Sample260808-wcdlda1hrg
- SHA256 14a320501d90bd7f7c19708db95ef18a9fce42efe19f6150e12c1798f51d91e3
- MD5 6cecbda98926dd776be71693b2c0554d
- SHA1 f66d506bb7fd250169ec9ebaef968a8abb95b2dd
- SHA512 659036e54e9166f2f18c422958da63d85bf1c0174747ea9fa58ba440601745e9b58fba50cfb47105bc5e02470487ac87fb7d343de5a51d117eaff415c0d1f45e
- SSDEEP 49152:xxgGhqFTTQAK3ckwq/qoHMThK+xgGhqFTTQAK3ckwq/qoHMThKM:EP23ckB/qoHMdMP23ckB/qoHMdZ
- TLSH T11B167D21F6C2C378E55580B555EDAFB6D40CFC2A076414C3ABE4BE23A9513C31E3AB69
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral1/files/0x00130000000243e9-2.dat family_shodi behavioral1/files/0x000500000001dac3-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 2844 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 1892 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4204 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4812 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 8 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 1076 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 748 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2888 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 368 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4924 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 1896 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4648 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 920 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 1540 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2356 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4932 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4984 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2696 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 1916 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4688 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3124 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3024 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 816 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 1992 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3252 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 5020 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 568 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4644 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4360 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4700 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4208 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3872 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2628 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4944 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4804 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 648 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4012 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3044 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 1560 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3332 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 1392 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3844 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3476 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4296 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4016 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 264 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 212 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2364 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2656 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 1912 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2032 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3424 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3096 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4732 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2976 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3940 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3752 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3736 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 916 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4192 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 796 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3552 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3376 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3396 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe - Drops file in Program Files directory 31 IoCs
description ioc Process File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.usa 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.usa 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.usa 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.usa 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.usa 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.usa 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.usa 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.usa 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.usa 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.usa 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 460 wrote to memory of 2844 460 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe 85 PID 2844 wrote to memory of 1892 2844 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 86 PID 1892 wrote to memory of 4204 1892 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 87 PID 4204 wrote to memory of 4812 4204 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 88 PID 4812 wrote to memory of 8 4812 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 89 PID 8 wrote to memory of 1076 8 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 90 PID 1076 wrote to memory of 748 1076 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 91 PID 748 wrote to memory of 2888 748 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 92 PID 2888 wrote to memory of 368 2888 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 93 PID 368 wrote to memory of 4924 368 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 94 PID 4924 wrote to memory of 1896 4924 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 95 PID 1896 wrote to memory of 4648 1896 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 96 PID 4648 wrote to memory of 920 4648 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 97 PID 920 wrote to memory of 1540 920 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 98 PID 1540 wrote to memory of 2356 1540 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 99 PID 2356 wrote to memory of 4932 2356 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 100 PID 4932 wrote to memory of 4984 4932 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 101 PID 4984 wrote to memory of 2696 4984 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 102 PID 2696 wrote to memory of 1916 2696 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 103 PID 1916 wrote to memory of 4688 1916 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 104 PID 4688 wrote to memory of 3124 4688 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 105 PID 3124 wrote to memory of 3024 3124 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 106 PID 3024 wrote to memory of 816 3024 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 107 PID 816 wrote to memory of 1992 816 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 108 PID 1992 wrote to memory of 3252 1992 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 109 PID 3252 wrote to memory of 5020 3252 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 110 PID 5020 wrote to memory of 568 5020 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 111 PID 568 wrote to memory of 4644 568 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 112 PID 4644 wrote to memory of 4360 4644 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 113 PID 4360 wrote to memory of 4700 4360 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 114 PID 4700 wrote to memory of 4208 4700 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 115 PID 4208 wrote to memory of 3872 4208 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 116 PID 3872 wrote to memory of 2628 3872 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 117 PID 2628 wrote to memory of 4944 2628 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 118 PID 4944 wrote to memory of 4804 4944 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 119 PID 4804 wrote to memory of 648 4804 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 120 PID 648 wrote to memory of 4012 648 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 121 PID 4012 wrote to memory of 3044 4012 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 122 PID 3044 wrote to memory of 1560 3044 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 123 PID 1560 wrote to memory of 3332 1560 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 124 PID 3332 wrote to memory of 1392 3332 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 125 PID 1392 wrote to memory of 3844 1392 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 126 PID 3844 wrote to memory of 3476 3844 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 127 PID 3476 wrote to memory of 4296 3476 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 128 PID 4296 wrote to memory of 4016 4296 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 129 PID 4016 wrote to memory of 264 4016 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 130 PID 264 wrote to memory of 212 264 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 131 PID 212 wrote to memory of 2364 212 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 132 PID 2364 wrote to memory of 2656 2364 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 133 PID 2656 wrote to memory of 1912 2656 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 134 PID 1912 wrote to memory of 2032 1912 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 135 PID 2032 wrote to memory of 3424 2032 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 136 PID 3424 wrote to memory of 3096 3424 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 137 PID 3096 wrote to memory of 4732 3096 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 138 PID 4732 wrote to memory of 2976 4732 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 139 PID 2976 wrote to memory of 3940 2976 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 140 PID 3940 wrote to memory of 3752 3940 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 141 PID 3752 wrote to memory of 3736 3752 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 142 PID 3736 wrote to memory of 916 3736 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 143 PID 916 wrote to memory of 4192 916 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 144 PID 4192 wrote to memory of 796 4192 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 145 PID 796 wrote to memory of 3552 796 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 146 PID 3552 wrote to memory of 3376 3552 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 147 PID 3376 wrote to memory of 3396 3376 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa66⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa67⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa68⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa69⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa70⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa71⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa72⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa73⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa74⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa75⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa76⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa77⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa78⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa79⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa80⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa81⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa82⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa83⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa84⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa85⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa86⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa87⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa88⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa89⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa90⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa91⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa92⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa93⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa94⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa95⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa96⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa97⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa98⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa99⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa100⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa101⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa102⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa103⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa104⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa105⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa106⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa107⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa108⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa109⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa110⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa111⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa112⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa113⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa114⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa115⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa116⤵PID:5248
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa117⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa118⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa119⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa120⤵
- System Location Discovery: System Language Discovery
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa121⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa122⤵PID:5344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-