Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 14:16
Behavioral task
behavioral1
Sample
2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe
- Size 1.2MB
- Sample260809-rlccfsag73
- SHA256 99ef8d01c809fd03b00cd6818cda8029f01b9bdbd5514d7f8899343f2b204c90
- MD5 6c639213a540e4014fe137b62dbfce95
- SHA1 4fd66d4c7ee9356c84647cfef3115e8ad5b4f29a
- SHA512 4a62b12eee5b169f3c11545c4ea6842db2ccbc2f747e9bc8feed366aafc073c02dbe09d95a4d11d009c83055887d3e88fe13663c3cdea9268e87da93e3594392
- SSDEEP 12288:BYixUrHGQVL9vwf+SqwLa8Cck3DTyUjDpYixUrHGQVL9vwf+SqwLa8Cck3DTyUjx:xxal9vGhqF3DTJxal9vGhqF3DTF
- TLSH T1B7555A13F65950B9D4AAC138971B6537BA72BC1907317EEB1780BB212E76BE06B3D700
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral1/files/0x00130000000243e9-2.dat family_shodi behavioral1/files/0x00180000000168e3-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 1056 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2392 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1408 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4812 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 8 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3808 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2308 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1980 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4896 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 536 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3256 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 920 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 784 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1960 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4932 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4984 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2696 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1916 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 660 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3124 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3024 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 816 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4608 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4724 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 568 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4644 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4276 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4120 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 456 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 828 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4460 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3584 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4280 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2204 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2980 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3700 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1924 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4180 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4588 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3824 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 376 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3500 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1656 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 232 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 220 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1588 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3352 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4956 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1296 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4428 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2408 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2652 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4436 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1268 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3244 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2092 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1248 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2416 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2824 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1448 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4080 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3360 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1484 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3068 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javacpl.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\misc.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaws.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaws.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaw.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaw.usa 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1864 wrote to memory of 1056 1864 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe 85 PID 1056 wrote to memory of 2392 1056 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 86 PID 2392 wrote to memory of 1408 2392 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 87 PID 1408 wrote to memory of 4812 1408 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 88 PID 4812 wrote to memory of 8 4812 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 89 PID 8 wrote to memory of 3808 8 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 90 PID 3808 wrote to memory of 2308 3808 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 91 PID 2308 wrote to memory of 1980 2308 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 92 PID 1980 wrote to memory of 4896 1980 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 93 PID 4896 wrote to memory of 536 4896 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 94 PID 536 wrote to memory of 3256 536 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 95 PID 3256 wrote to memory of 920 3256 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 96 PID 920 wrote to memory of 784 920 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 97 PID 784 wrote to memory of 1960 784 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 98 PID 1960 wrote to memory of 4932 1960 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 99 PID 4932 wrote to memory of 4984 4932 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 100 PID 4984 wrote to memory of 2696 4984 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 101 PID 2696 wrote to memory of 1916 2696 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 102 PID 1916 wrote to memory of 660 1916 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 103 PID 660 wrote to memory of 3124 660 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 104 PID 3124 wrote to memory of 3024 3124 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 105 PID 3024 wrote to memory of 816 3024 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 106 PID 816 wrote to memory of 4608 816 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 107 PID 4608 wrote to memory of 4724 4608 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 108 PID 4724 wrote to memory of 568 4724 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 109 PID 568 wrote to memory of 4644 568 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 110 PID 4644 wrote to memory of 4276 4644 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 111 PID 4276 wrote to memory of 4120 4276 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 112 PID 4120 wrote to memory of 456 4120 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 113 PID 456 wrote to memory of 828 456 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 114 PID 828 wrote to memory of 4460 828 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 115 PID 4460 wrote to memory of 3584 4460 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 116 PID 3584 wrote to memory of 4280 3584 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 117 PID 4280 wrote to memory of 2204 4280 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 118 PID 2204 wrote to memory of 2980 2204 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 119 PID 2980 wrote to memory of 3700 2980 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 120 PID 3700 wrote to memory of 1924 3700 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 121 PID 1924 wrote to memory of 4180 1924 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 122 PID 4180 wrote to memory of 4588 4180 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 123 PID 4588 wrote to memory of 3824 4588 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 124 PID 3824 wrote to memory of 376 3824 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 125 PID 376 wrote to memory of 3500 376 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 126 PID 3500 wrote to memory of 1656 3500 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 127 PID 1656 wrote to memory of 232 1656 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 128 PID 232 wrote to memory of 220 232 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 129 PID 220 wrote to memory of 1588 220 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 130 PID 1588 wrote to memory of 3352 1588 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 131 PID 3352 wrote to memory of 4956 3352 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 132 PID 4956 wrote to memory of 1296 4956 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 133 PID 1296 wrote to memory of 4428 1296 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 134 PID 4428 wrote to memory of 2408 4428 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 135 PID 2408 wrote to memory of 2652 2408 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 136 PID 2652 wrote to memory of 4436 2652 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 137 PID 4436 wrote to memory of 1268 4436 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 138 PID 1268 wrote to memory of 3244 1268 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 139 PID 3244 wrote to memory of 2092 3244 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 140 PID 2092 wrote to memory of 1248 2092 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 141 PID 1248 wrote to memory of 2416 1248 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 142 PID 2416 wrote to memory of 2824 2416 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 143 PID 2824 wrote to memory of 1448 2824 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 144 PID 1448 wrote to memory of 4080 1448 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 145 PID 4080 wrote to memory of 3360 4080 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 146 PID 3360 wrote to memory of 1484 3360 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 147 PID 1484 wrote to memory of 3068 1484 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa66⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa67⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa68⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa69⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa70⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa71⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa72⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa73⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa74⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa75⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa76⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa77⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa78⤵
- System Location Discovery: System Language Discovery
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa79⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa80⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa81⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa82⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa83⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa84⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa85⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa86⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa87⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa88⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa89⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa90⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa91⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa92⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa93⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa94⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa95⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa96⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa97⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa98⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa99⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa100⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa101⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa102⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa103⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa104⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa105⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa106⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa107⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa108⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa109⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa110⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa111⤵
- System Location Discovery: System Language Discovery
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa112⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa113⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa114⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa115⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa116⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa117⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa118⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa119⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa120⤵
- System Location Discovery: System Language Discovery
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa121⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa122⤵PID:5292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-