Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 17:46
Behavioral task
behavioral1
Sample
2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe
- Size 4.1MB
- Sample260808-wcdlda1hrg
- SHA256 14a320501d90bd7f7c19708db95ef18a9fce42efe19f6150e12c1798f51d91e3
- MD5 6cecbda98926dd776be71693b2c0554d
- SHA1 f66d506bb7fd250169ec9ebaef968a8abb95b2dd
- SHA512 659036e54e9166f2f18c422958da63d85bf1c0174747ea9fa58ba440601745e9b58fba50cfb47105bc5e02470487ac87fb7d343de5a51d117eaff415c0d1f45e
- SSDEEP 49152:xxgGhqFTTQAK3ckwq/qoHMThK+xgGhqFTTQAK3ckwq/qoHMThKM:EP23ckB/qoHMdMP23ckB/qoHMdZ
- TLSH T11B167D21F6C2C378E55580B555EDAFB6D40CFC2A076414C3ABE4BE23A9513C31E3AB69
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000800000001b83c-3.dat family_shodi behavioral2/files/0x000d00000001c539-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 1800 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 1120 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4464 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 872 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2868 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3316 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2248 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3284 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 5948 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2352 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 5956 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2672 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4720 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4724 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 244 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4584 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 1464 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 572 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 1692 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 5844 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4540 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 5932 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4108 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4340 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4580 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2908 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 5652 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3172 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 1176 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 5832 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4856 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2124 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 1196 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 5500 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 5140 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4296 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2668 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 6004 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 5280 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 6052 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 5340 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2648 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4180 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4576 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 708 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 6092 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2544 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 576 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3856 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2976 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4404 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 6060 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 6024 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4964 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 5476 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2204 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 1948 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3428 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 2616 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 4496 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3368 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3680 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 1668 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 3260 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1776 wrote to memory of 1800 1776 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe 89 PID 1800 wrote to memory of 1120 1800 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 90 PID 1120 wrote to memory of 4464 1120 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 91 PID 4464 wrote to memory of 872 4464 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 92 PID 872 wrote to memory of 2868 872 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 93 PID 2868 wrote to memory of 3316 2868 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 94 PID 3316 wrote to memory of 2248 3316 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 95 PID 2248 wrote to memory of 3284 2248 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 96 PID 3284 wrote to memory of 5948 3284 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 97 PID 5948 wrote to memory of 2352 5948 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 98 PID 2352 wrote to memory of 5956 2352 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 99 PID 5956 wrote to memory of 2672 5956 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 100 PID 2672 wrote to memory of 4720 2672 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 101 PID 4720 wrote to memory of 4724 4720 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 102 PID 4724 wrote to memory of 244 4724 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 103 PID 244 wrote to memory of 4584 244 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 104 PID 4584 wrote to memory of 1464 4584 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 105 PID 1464 wrote to memory of 572 1464 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 106 PID 572 wrote to memory of 1692 572 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 107 PID 1692 wrote to memory of 5844 1692 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 108 PID 5844 wrote to memory of 4540 5844 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 109 PID 4540 wrote to memory of 5932 4540 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 110 PID 5932 wrote to memory of 4108 5932 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 111 PID 4108 wrote to memory of 4340 4108 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 112 PID 4340 wrote to memory of 4580 4340 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 113 PID 4580 wrote to memory of 2908 4580 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 114 PID 2908 wrote to memory of 5652 2908 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 115 PID 5652 wrote to memory of 3172 5652 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 116 PID 3172 wrote to memory of 1176 3172 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 117 PID 1176 wrote to memory of 5832 1176 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 118 PID 5832 wrote to memory of 4856 5832 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 119 PID 4856 wrote to memory of 2124 4856 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 120 PID 2124 wrote to memory of 1196 2124 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 121 PID 1196 wrote to memory of 5500 1196 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 122 PID 5500 wrote to memory of 5140 5500 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 123 PID 5140 wrote to memory of 4296 5140 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 124 PID 4296 wrote to memory of 2668 4296 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 125 PID 2668 wrote to memory of 6004 2668 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 126 PID 6004 wrote to memory of 5280 6004 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 127 PID 5280 wrote to memory of 6052 5280 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 128 PID 6052 wrote to memory of 5340 6052 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 129 PID 5340 wrote to memory of 2648 5340 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 130 PID 2648 wrote to memory of 4180 2648 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 131 PID 4180 wrote to memory of 4576 4180 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 132 PID 4576 wrote to memory of 708 4576 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 133 PID 708 wrote to memory of 6092 708 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 134 PID 6092 wrote to memory of 2544 6092 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 135 PID 2544 wrote to memory of 576 2544 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 136 PID 576 wrote to memory of 3856 576 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 137 PID 3856 wrote to memory of 2976 3856 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 138 PID 2976 wrote to memory of 4404 2976 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 139 PID 4404 wrote to memory of 6060 4404 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 140 PID 6060 wrote to memory of 6024 6060 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 141 PID 6024 wrote to memory of 4964 6024 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 142 PID 4964 wrote to memory of 5476 4964 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 143 PID 5476 wrote to memory of 2204 5476 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 144 PID 2204 wrote to memory of 1948 2204 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 145 PID 1948 wrote to memory of 3428 1948 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 146 PID 3428 wrote to memory of 2616 3428 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 147 PID 2616 wrote to memory of 4496 2616 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 148 PID 4496 wrote to memory of 3368 4496 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 149 PID 3368 wrote to memory of 3680 3368 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 150 PID 3680 wrote to memory of 1668 3680 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 151 PID 1668 wrote to memory of 3260 1668 2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa66⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa67⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa68⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa69⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa70⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa71⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa72⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa73⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa74⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa75⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa76⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa77⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa78⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa79⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa80⤵PID:6028
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa81⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa82⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa83⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa84⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa85⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa86⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa87⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa88⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa89⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa90⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa91⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa92⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa93⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa94⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa95⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa96⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa97⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa98⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa99⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa100⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa101⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa102⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa103⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa104⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa105⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa106⤵
- System Location Discovery: System Language Discovery
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa107⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa108⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa109⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa110⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa111⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa112⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa113⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa114⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa115⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa116⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa117⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa118⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa119⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa120⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa121⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_6cecbda98926dd776be71693b2c0554d_akira_cloudeye_elex_remcos_rhadamanthys.usa122⤵PID:3120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-