Analysis
- max time kernel
51s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/09/2026, 13:07
Behavioral task
behavioral1
Sample
2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe
Resource
win10v2004-20260911-en
7 signatures
150 seconds
General
- Target 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe
- Size 1.2MB
- Sample260913-qctppstgrf
- SHA256 fefe353ff4e679914899e5b12df57e0559f10b7ef8f70fb5f0ff91578c20d5fa
- MD5 8411e419b3bfcaedfa43bed826d6942c
- SHA1 985161d1216044c2ed1c90f8f5464b5d04404d3f
- SHA512 9c03c899bff889d4601ae707cde5c59155d35f792965fe6217eeddd1b38a590da649b281d193e46ae6356ac93a52e8734f0a4e795e95eddb7dc435aa15c9e536
- SSDEEP 12288:tYixUrHGQVL9vwf+SqwLa8Cck3DTyuEYixUrHGQVL9vwf+SqwLa8Cck3DTyum:Fxal9vGhqF3DTuxal9vGhqF3DTk
- TLSH T118556A13F65950B8D4AAC178971A6532FA72BC5907317EEF1780AB213E76BE06B3D700
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral1/files/0x0008000000021709-2.dat family_shodi behavioral1/files/0x0009000000024627-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 468 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 6064 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 4636 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 552 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 3788 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 4724 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 4732 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 5252 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 6032 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 4788 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 5192 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 5564 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 3152 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 5524 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 2064 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 3800 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 4352 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 5680 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 1716 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 3312 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 3308 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 3140 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 5764 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 3960 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 1860 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 4776 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 628 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 3264 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 2848 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 2904 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 1148 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 3776 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 4772 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 3192 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 2628 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 2852 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 4132 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 1664 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 1732 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 3664 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 1060 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 2208 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 5452 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 4524 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 3504 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 5160 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 5816 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 5488 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 3852 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 804 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 5400 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 512 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 3364 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 5496 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 1592 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 964 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 5068 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 5364 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 4844 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 4488 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 6104 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 6108 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 4088 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 3084 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe - Drops file in Program Files directory 37 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.usa 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.usa 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.usa 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.usa 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.usa 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.usa 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.usa 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.usa 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.usa 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.usa 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.usa 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.usa 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.usa 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5700 wrote to memory of 468 5700 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe 84 PID 468 wrote to memory of 6064 468 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 85 PID 6064 wrote to memory of 4636 6064 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 86 PID 4636 wrote to memory of 552 4636 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 87 PID 552 wrote to memory of 3788 552 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 88 PID 3788 wrote to memory of 4724 3788 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 89 PID 4724 wrote to memory of 4732 4724 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 90 PID 4732 wrote to memory of 5252 4732 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 91 PID 5252 wrote to memory of 6032 5252 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 92 PID 6032 wrote to memory of 4788 6032 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 93 PID 4788 wrote to memory of 5192 4788 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 94 PID 5192 wrote to memory of 5564 5192 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 95 PID 5564 wrote to memory of 3152 5564 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 96 PID 3152 wrote to memory of 5524 3152 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 97 PID 5524 wrote to memory of 2064 5524 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 98 PID 2064 wrote to memory of 3800 2064 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 99 PID 3800 wrote to memory of 4352 3800 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 100 PID 4352 wrote to memory of 5680 4352 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 101 PID 5680 wrote to memory of 1716 5680 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 102 PID 1716 wrote to memory of 3312 1716 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 103 PID 3312 wrote to memory of 3308 3312 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 104 PID 3308 wrote to memory of 3140 3308 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 105 PID 3140 wrote to memory of 5764 3140 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 106 PID 5764 wrote to memory of 3960 5764 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 107 PID 3960 wrote to memory of 1860 3960 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 108 PID 1860 wrote to memory of 4776 1860 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 109 PID 4776 wrote to memory of 628 4776 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 110 PID 628 wrote to memory of 3264 628 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 111 PID 3264 wrote to memory of 2848 3264 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 112 PID 2848 wrote to memory of 2904 2848 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 113 PID 2904 wrote to memory of 1148 2904 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 114 PID 1148 wrote to memory of 3776 1148 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 115 PID 3776 wrote to memory of 4772 3776 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 116 PID 4772 wrote to memory of 3192 4772 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 117 PID 3192 wrote to memory of 2628 3192 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 118 PID 2628 wrote to memory of 2852 2628 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 119 PID 2852 wrote to memory of 4132 2852 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 120 PID 4132 wrote to memory of 1664 4132 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 121 PID 1664 wrote to memory of 1732 1664 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 122 PID 1732 wrote to memory of 3664 1732 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 123 PID 3664 wrote to memory of 1060 3664 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 124 PID 1060 wrote to memory of 2208 1060 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 125 PID 2208 wrote to memory of 5452 2208 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 126 PID 5452 wrote to memory of 4524 5452 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 127 PID 4524 wrote to memory of 3504 4524 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 128 PID 3504 wrote to memory of 5160 3504 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 129 PID 5160 wrote to memory of 5816 5160 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 130 PID 5816 wrote to memory of 5488 5816 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 131 PID 5488 wrote to memory of 3852 5488 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 132 PID 3852 wrote to memory of 804 3852 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 133 PID 804 wrote to memory of 5400 804 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 134 PID 5400 wrote to memory of 512 5400 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 135 PID 512 wrote to memory of 3364 512 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 136 PID 3364 wrote to memory of 5496 3364 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 137 PID 5496 wrote to memory of 1592 5496 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 138 PID 1592 wrote to memory of 964 1592 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 139 PID 964 wrote to memory of 5068 964 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 140 PID 5068 wrote to memory of 5364 5068 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 141 PID 5364 wrote to memory of 4844 5364 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 142 PID 4844 wrote to memory of 4488 4844 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 143 PID 4488 wrote to memory of 6104 4488 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 144 PID 6104 wrote to memory of 6108 6104 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 145 PID 6108 wrote to memory of 4088 6108 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 146 PID 4088 wrote to memory of 3084 4088 2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa66⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa67⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa68⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa69⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa70⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa71⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa72⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa73⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa74⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa75⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa76⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa77⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa78⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa79⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa80⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa81⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa82⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa83⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa84⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa85⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa86⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa87⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa88⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa89⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa90⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa91⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa92⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa93⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa94⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa95⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa96⤵PID:5288
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa97⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa98⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa99⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa100⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa101⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa102⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa103⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa104⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa105⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa106⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa107⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa108⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa109⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa110⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa111⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa112⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa113⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa114⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa115⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa116⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa117⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa118⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa119⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa120⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa121⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-13_8411e419b3bfcaedfa43bed826d6942c_akira_cloudeye_elex_rhadamanthys.usa122⤵PID:2252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-