Analysis
- max time kernel
116s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 04:25
Behavioral task
behavioral1
Sample
2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe
Resource
win10v2004-20260130-en
8 signatures
150 seconds
General
- Target 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe
- Size 1.6MB
- Sample260415-e13rqsew7m
- SHA256 9d93524fe9dc53deffba4053496587f07a0e4fe9bd4b8e84c680cb0b81fe2edc
- MD5 40eddf1489fd6eeaa346085fafc549fc
- SHA1 aa7b1693cde44265a5fab96ba6524ba1ba28bf22
- SHA512 788c4386ac47b02fbe49da70306cde5ee8f372ffc11bb6227155491c316eb8264438be78b1777e5e3d0dccc2c781c42a996f54b1c3160ef45e98fb9ebd175de3
- SSDEEP 24576:Xxal9vGhqF3ntTur9xal9vGhqF3ntTurz:XxgGhqF3tTO9xgGhqF3tTOz
- TLSH T181757B57F68500BCD06AD178834B6436F662B85A07307EEF5790EB212E7ABE06B3D744
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral1/files/0x0009000000021698-2.dat family_shodi behavioral1/files/0x00080000000243e5-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 4512 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1048 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 3800 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1812 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4404 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1820 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5584 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 2340 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4728 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4344 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4788 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4724 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4744 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4848 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4876 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5596 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4864 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4924 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5636 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5724 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5276 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4072 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 6076 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1388 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1148 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 2540 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4704 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4692 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5336 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 6084 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5984 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4276 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 3220 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1244 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 6080 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4224 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1556 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 2728 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5840 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5972 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5512 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5988 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 6000 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4572 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 2236 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4160 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4536 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1676 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5524 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1592 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1788 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 3064 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5136 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4988 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1792 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 2164 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 3980 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 3136 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4944 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 648 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4100 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5296 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1516 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4984 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\WORDICON.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Mozilla Firefox\crashreporter.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\uninstall\helper.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaws.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\plugin-container.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4604 wrote to memory of 4512 4604 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe 85 PID 4512 wrote to memory of 1048 4512 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 86 PID 1048 wrote to memory of 3800 1048 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 87 PID 3800 wrote to memory of 1812 3800 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 88 PID 1812 wrote to memory of 4404 1812 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 89 PID 4404 wrote to memory of 1820 4404 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 90 PID 1820 wrote to memory of 5584 1820 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 91 PID 5584 wrote to memory of 2340 5584 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 92 PID 2340 wrote to memory of 4728 2340 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 93 PID 4728 wrote to memory of 4344 4728 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 94 PID 4344 wrote to memory of 4788 4344 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 95 PID 4788 wrote to memory of 4724 4788 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 96 PID 4724 wrote to memory of 4744 4724 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 97 PID 4744 wrote to memory of 4848 4744 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 98 PID 4848 wrote to memory of 4876 4848 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 99 PID 4876 wrote to memory of 5596 4876 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 100 PID 5596 wrote to memory of 4864 5596 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 101 PID 4864 wrote to memory of 4924 4864 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 102 PID 4924 wrote to memory of 5636 4924 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 103 PID 5636 wrote to memory of 5724 5636 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 104 PID 5724 wrote to memory of 5276 5724 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 105 PID 5276 wrote to memory of 4072 5276 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 106 PID 4072 wrote to memory of 6076 4072 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 107 PID 6076 wrote to memory of 1388 6076 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 108 PID 1388 wrote to memory of 1148 1388 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 109 PID 1148 wrote to memory of 2540 1148 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 110 PID 2540 wrote to memory of 4704 2540 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 111 PID 4704 wrote to memory of 4692 4704 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 112 PID 4692 wrote to memory of 5336 4692 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 113 PID 5336 wrote to memory of 6084 5336 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 114 PID 6084 wrote to memory of 5984 6084 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 115 PID 5984 wrote to memory of 4276 5984 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 116 PID 4276 wrote to memory of 3220 4276 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 117 PID 3220 wrote to memory of 1244 3220 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 118 PID 1244 wrote to memory of 6080 1244 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 119 PID 6080 wrote to memory of 4224 6080 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 120 PID 4224 wrote to memory of 1556 4224 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 121 PID 1556 wrote to memory of 2728 1556 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 122 PID 2728 wrote to memory of 5840 2728 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 123 PID 5840 wrote to memory of 5972 5840 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 124 PID 5972 wrote to memory of 5512 5972 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 125 PID 5512 wrote to memory of 5988 5512 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 126 PID 5988 wrote to memory of 6000 5988 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 127 PID 6000 wrote to memory of 4572 6000 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 128 PID 4572 wrote to memory of 2236 4572 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 129 PID 2236 wrote to memory of 4160 2236 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 130 PID 4160 wrote to memory of 4536 4160 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 131 PID 4536 wrote to memory of 1676 4536 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 132 PID 1676 wrote to memory of 5524 1676 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 133 PID 5524 wrote to memory of 1592 5524 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 134 PID 1592 wrote to memory of 1788 1592 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 135 PID 1788 wrote to memory of 3064 1788 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 136 PID 3064 wrote to memory of 5136 3064 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 137 PID 5136 wrote to memory of 4988 5136 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 138 PID 4988 wrote to memory of 1792 4988 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 139 PID 1792 wrote to memory of 2164 1792 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 140 PID 2164 wrote to memory of 3980 2164 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 141 PID 3980 wrote to memory of 3136 3980 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 142 PID 3136 wrote to memory of 4944 3136 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 143 PID 4944 wrote to memory of 648 4944 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 144 PID 648 wrote to memory of 4100 648 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 145 PID 4100 wrote to memory of 5296 4100 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 146 PID 5296 wrote to memory of 1516 5296 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 147 PID 1516 wrote to memory of 4984 1516 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa66⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa67⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa68⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa69⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa70⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa71⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa72⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa73⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa74⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa75⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa76⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa77⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa78⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa79⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa80⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa81⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa82⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa83⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa84⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa85⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa86⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa87⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa88⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa89⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa90⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa91⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa92⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa93⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa94⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa95⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa96⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa97⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa98⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa99⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa100⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa101⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa102⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa103⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa104⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa105⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa106⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa107⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa108⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa109⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa110⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa111⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa112⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa113⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa114⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa115⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa116⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa117⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa118⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa119⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa120⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa121⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa122⤵PID:2704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-