Analysis
- max time kernel
94s - max time network
100s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 04:25
Behavioral task
behavioral1
Sample
2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe
Resource
win10v2004-20260130-en
8 signatures
150 seconds
General
- Target 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe
- Size 1.6MB
- Sample260415-e13rqsew7m
- SHA256 9d93524fe9dc53deffba4053496587f07a0e4fe9bd4b8e84c680cb0b81fe2edc
- MD5 40eddf1489fd6eeaa346085fafc549fc
- SHA1 aa7b1693cde44265a5fab96ba6524ba1ba28bf22
- SHA512 788c4386ac47b02fbe49da70306cde5ee8f372ffc11bb6227155491c316eb8264438be78b1777e5e3d0dccc2c781c42a996f54b1c3160ef45e98fb9ebd175de3
- SSDEEP 24576:Xxal9vGhqF3ntTur9xal9vGhqF3ntTurz:XxgGhqF3tTO9xgGhqF3tTOz
- TLSH T181757B57F68500BCD06AD178834B6436F662B85A07307EEF5790EB212E7ABE06B3D744
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x0012000000026154-2.dat family_shodi behavioral2/files/0x001a00000002b3c1-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 4412 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 3400 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 3476 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 3664 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5020 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 2492 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4968 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 3004 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4464 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 72 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5004 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4232 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4308 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 3436 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 2040 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5976 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4080 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 3376 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 3224 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 2916 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1932 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 2940 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 3076 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5380 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 6132 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1092 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4160 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5440 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4468 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4004 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 2296 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5632 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 2372 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5928 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5604 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 3980 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 2088 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1252 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 6108 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1564 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5264 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5680 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 740 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4860 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 388 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1644 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1636 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5372 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1872 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 2912 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 420 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 1440 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 2244 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 2176 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4732 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 556 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 3604 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 4880 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5492 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5416 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 2168 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 5192 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 2412 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 3660 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\Mozilla Firefox\private_browsing.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\uninstall.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\firefox.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Mozilla Firefox\plugin-container.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSREC.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\misc.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\crashreporter.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\default-browser-agent.usa 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Mozilla Firefox\updater.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5052 wrote to memory of 4412 5052 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe 78 PID 4412 wrote to memory of 3400 4412 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 79 PID 3400 wrote to memory of 3476 3400 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 80 PID 3476 wrote to memory of 3664 3476 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 81 PID 3664 wrote to memory of 5020 3664 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 82 PID 5020 wrote to memory of 2492 5020 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 83 PID 2492 wrote to memory of 4968 2492 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 84 PID 4968 wrote to memory of 3004 4968 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 85 PID 3004 wrote to memory of 4464 3004 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 86 PID 4464 wrote to memory of 72 4464 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 87 PID 72 wrote to memory of 5004 72 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 88 PID 5004 wrote to memory of 4232 5004 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 89 PID 4232 wrote to memory of 4308 4232 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 90 PID 4308 wrote to memory of 3436 4308 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 91 PID 3436 wrote to memory of 2040 3436 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 92 PID 2040 wrote to memory of 5976 2040 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 93 PID 5976 wrote to memory of 4080 5976 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 94 PID 4080 wrote to memory of 3376 4080 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 95 PID 3376 wrote to memory of 3224 3376 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 96 PID 3224 wrote to memory of 2916 3224 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 97 PID 2916 wrote to memory of 1932 2916 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 98 PID 1932 wrote to memory of 2940 1932 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 99 PID 2940 wrote to memory of 3076 2940 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 100 PID 3076 wrote to memory of 5380 3076 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 101 PID 5380 wrote to memory of 6132 5380 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 102 PID 6132 wrote to memory of 1092 6132 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 103 PID 1092 wrote to memory of 4160 1092 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 104 PID 4160 wrote to memory of 5440 4160 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 105 PID 5440 wrote to memory of 4468 5440 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 106 PID 4468 wrote to memory of 4004 4468 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 107 PID 4004 wrote to memory of 2296 4004 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 108 PID 2296 wrote to memory of 5632 2296 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 109 PID 5632 wrote to memory of 2372 5632 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 110 PID 2372 wrote to memory of 5928 2372 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 111 PID 5928 wrote to memory of 5604 5928 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 112 PID 5604 wrote to memory of 3980 5604 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 113 PID 3980 wrote to memory of 2088 3980 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 114 PID 2088 wrote to memory of 1252 2088 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 115 PID 1252 wrote to memory of 6108 1252 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 116 PID 6108 wrote to memory of 1564 6108 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 117 PID 1564 wrote to memory of 5264 1564 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 118 PID 5264 wrote to memory of 5680 5264 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 119 PID 5680 wrote to memory of 740 5680 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 120 PID 740 wrote to memory of 4860 740 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 121 PID 4860 wrote to memory of 388 4860 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 122 PID 388 wrote to memory of 1644 388 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 123 PID 1644 wrote to memory of 1636 1644 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 124 PID 1636 wrote to memory of 5372 1636 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 125 PID 5372 wrote to memory of 1872 5372 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 126 PID 1872 wrote to memory of 2912 1872 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 127 PID 2912 wrote to memory of 420 2912 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 128 PID 420 wrote to memory of 1440 420 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 129 PID 1440 wrote to memory of 2244 1440 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 130 PID 2244 wrote to memory of 2176 2244 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 131 PID 2176 wrote to memory of 4732 2176 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 132 PID 4732 wrote to memory of 556 4732 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 133 PID 556 wrote to memory of 3604 556 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 134 PID 3604 wrote to memory of 4880 3604 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 135 PID 4880 wrote to memory of 5492 4880 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 136 PID 5492 wrote to memory of 5416 5492 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 137 PID 5416 wrote to memory of 2168 5416 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 138 PID 2168 wrote to memory of 5192 2168 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 139 PID 5192 wrote to memory of 2412 5192 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 140 PID 2412 wrote to memory of 3660 2412 2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa 141
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:72 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa66⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa67⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa68⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa69⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa70⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa71⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa72⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa73⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa74⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa75⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa76⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa77⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa78⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa79⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa80⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa81⤵
- System Location Discovery: System Language Discovery
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa82⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa83⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa84⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa85⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa86⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa87⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa88⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa89⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa90⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa91⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa92⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa93⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa94⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa95⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa96⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa97⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa98⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa99⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa100⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa101⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa102⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa103⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa104⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa105⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa106⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa107⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa108⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa109⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa110⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa111⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa112⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa113⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa114⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa115⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa116⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa117⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa118⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa119⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa120⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa121⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-15_40eddf1489fd6eeaa346085fafc549fc_akira_elex_rhadamanthys.usa122⤵PID:2896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-