Analysis
- max time kernel
27s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 14:16
Behavioral task
behavioral1
Sample
2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe
- Size 1.2MB
- Sample260809-rlccfsag73
- SHA256 99ef8d01c809fd03b00cd6818cda8029f01b9bdbd5514d7f8899343f2b204c90
- MD5 6c639213a540e4014fe137b62dbfce95
- SHA1 4fd66d4c7ee9356c84647cfef3115e8ad5b4f29a
- SHA512 4a62b12eee5b169f3c11545c4ea6842db2ccbc2f747e9bc8feed366aafc073c02dbe09d95a4d11d009c83055887d3e88fe13663c3cdea9268e87da93e3594392
- SSDEEP 12288:BYixUrHGQVL9vwf+SqwLa8Cck3DTyUjDpYixUrHGQVL9vwf+SqwLa8Cck3DTyUjx:xxal9vGhqF3DTJxal9vGhqF3DTF
- TLSH T1B7555A13F65950B9D4AAC138971B6537BA72BC1907317EEB1780BB212E76BE06B3D700
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000b00000001b315-3.dat family_shodi behavioral2/files/0x000d00000001c561-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 1472 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4064 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3428 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 5820 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2496 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4528 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 5848 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1356 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1264 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4348 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2944 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3732 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 616 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4648 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 5320 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 352 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 252 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 5876 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2636 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2912 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2884 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2580 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1360 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2252 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 6088 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 6116 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3908 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2936 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 5712 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 472 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 480 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2796 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1244 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3504 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 5532 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2440 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 5956 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2788 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 844 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3884 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4596 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1976 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 5528 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1972 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2328 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3652 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1392 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1216 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1556 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1128 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3848 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2076 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 5048 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 4624 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1124 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1732 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3068 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2088 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 1876 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2460 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 2240 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 3600 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 5488 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 5024 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1248 wrote to memory of 1472 1248 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe 89 PID 1472 wrote to memory of 4064 1472 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 90 PID 4064 wrote to memory of 3428 4064 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 91 PID 3428 wrote to memory of 5820 3428 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 92 PID 5820 wrote to memory of 2496 5820 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 93 PID 2496 wrote to memory of 4528 2496 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 94 PID 4528 wrote to memory of 5848 4528 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 95 PID 5848 wrote to memory of 1356 5848 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 96 PID 1356 wrote to memory of 1264 1356 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 97 PID 1264 wrote to memory of 4348 1264 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 98 PID 4348 wrote to memory of 2944 4348 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 99 PID 2944 wrote to memory of 3732 2944 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 100 PID 3732 wrote to memory of 616 3732 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 101 PID 616 wrote to memory of 4648 616 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 102 PID 4648 wrote to memory of 5320 4648 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 103 PID 5320 wrote to memory of 352 5320 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 104 PID 352 wrote to memory of 252 352 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 105 PID 252 wrote to memory of 5876 252 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 106 PID 5876 wrote to memory of 2636 5876 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 107 PID 2636 wrote to memory of 2912 2636 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 108 PID 2912 wrote to memory of 2884 2912 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 109 PID 2884 wrote to memory of 2580 2884 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 110 PID 2580 wrote to memory of 1360 2580 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 111 PID 1360 wrote to memory of 2252 1360 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 112 PID 2252 wrote to memory of 6088 2252 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 113 PID 6088 wrote to memory of 6116 6088 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 114 PID 6116 wrote to memory of 3908 6116 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 115 PID 3908 wrote to memory of 2936 3908 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 116 PID 2936 wrote to memory of 5712 2936 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 117 PID 5712 wrote to memory of 472 5712 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 118 PID 472 wrote to memory of 480 472 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 119 PID 480 wrote to memory of 2796 480 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 120 PID 2796 wrote to memory of 1244 2796 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 121 PID 1244 wrote to memory of 3504 1244 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 122 PID 3504 wrote to memory of 5532 3504 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 123 PID 5532 wrote to memory of 2440 5532 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 124 PID 2440 wrote to memory of 5956 2440 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 125 PID 5956 wrote to memory of 2788 5956 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 126 PID 2788 wrote to memory of 844 2788 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 127 PID 844 wrote to memory of 3884 844 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 128 PID 3884 wrote to memory of 4596 3884 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 129 PID 4596 wrote to memory of 1976 4596 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 130 PID 1976 wrote to memory of 5528 1976 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 131 PID 5528 wrote to memory of 1972 5528 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 132 PID 1972 wrote to memory of 2328 1972 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 133 PID 2328 wrote to memory of 3652 2328 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 134 PID 3652 wrote to memory of 1392 3652 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 135 PID 1392 wrote to memory of 1216 1392 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 136 PID 1216 wrote to memory of 1556 1216 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 137 PID 1556 wrote to memory of 1128 1556 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 138 PID 1128 wrote to memory of 3848 1128 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 139 PID 3848 wrote to memory of 2076 3848 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 140 PID 2076 wrote to memory of 5048 2076 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 141 PID 5048 wrote to memory of 4624 5048 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 142 PID 4624 wrote to memory of 1124 4624 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 143 PID 1124 wrote to memory of 1732 1124 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 144 PID 1732 wrote to memory of 3068 1732 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 145 PID 3068 wrote to memory of 2088 3068 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 146 PID 2088 wrote to memory of 1876 2088 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 147 PID 1876 wrote to memory of 2460 1876 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 148 PID 2460 wrote to memory of 2240 2460 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 149 PID 2240 wrote to memory of 3600 2240 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 150 PID 3600 wrote to memory of 5488 3600 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 151 PID 5488 wrote to memory of 5024 5488 2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa66⤵
- System Location Discovery: System Language Discovery
PID:568 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa67⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa68⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa69⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa70⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa71⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa72⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa73⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa74⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa75⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa76⤵
- System Location Discovery: System Language Discovery
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa77⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa78⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa79⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa80⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa81⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa82⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa83⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa84⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa85⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa86⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa87⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa88⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa89⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa90⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa91⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa92⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa93⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa94⤵
- System Location Discovery: System Language Discovery
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa95⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa96⤵PID:6028
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa97⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa98⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa99⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa100⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa101⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa102⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa103⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa104⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa105⤵
- System Location Discovery: System Language Discovery
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa106⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa107⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa108⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa109⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa110⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa111⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa112⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa113⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa114⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa115⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa116⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa117⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa118⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa119⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa120⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa121⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-09_6c639213a540e4014fe137b62dbfce95_akira_cloudeye_elex_rhadamanthys.usa122⤵PID:5456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-