Analysis
- max time kernel
150s - max time network
115s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 15:38
Behavioral task
behavioral1
Sample
2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
General
- Target 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe
- Size 3.4MB
- Sample260602-s3flwahs5v
- SHA256 a50bb475eb3e0ce95cc895a8b09c7470a59296f3488541032491b854da63cb72
- MD5 b4c351cd2275eda45244dfd327a66587
- SHA1 93446d660f8905dd3974ab274829f1523bbb3916
- SHA512 2f0104b9560d68ed80f3a2a9e9f63419701098d8286cb82d0fe65cf7d39430b5487b7fbbb4d9d61d0a7259e42c16f7ef0388c18fbe20c6002102018f093b2249
- SSDEEP 98304:aB2UgXq9ouFkULGyqobaB2UgXq9ouFkULGyqobB:22S9+ULd22S9+ULdB
- TLSH T1F1F5B013B7E15079E847A271A21EBA36E5ABF8140331A9E747C29D213F60BD3673B345
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x001e00000002b309-2.dat family_shodi behavioral2/files/0x000300000002a213-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 3660 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 1772 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 672 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 4412 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 2856 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 2844 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 1756 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 4512 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 680 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 4892 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 4488 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 2700 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 2868 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 4156 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 3984 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 2128 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 2620 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 1656 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 2192 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 3428 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 2044 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 1316 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 5024 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 1216 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 1820 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 4100 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 3436 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 1368 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 3372 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 1728 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 2120 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 2440 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 3196 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 5072 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 2592 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 400 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 1924 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 796 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 3172 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 4492 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 2232 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 3512 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 1868 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 328 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 236 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 2156 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 2608 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 4904 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 1128 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 4604 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 3136 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 4664 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 2464 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 1168 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 3724 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 4884 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 2520 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 4028 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 1912 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 1768 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 800 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 3456 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 4708 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 1092 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaws.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaws.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javacpl.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CNFNOT32.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaw.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaw.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\misc.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoasb.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1512 wrote to memory of 3660 1512 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe 82 PID 3660 wrote to memory of 1772 3660 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 83 PID 1772 wrote to memory of 672 1772 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 84 PID 672 wrote to memory of 4412 672 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 85 PID 4412 wrote to memory of 2856 4412 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 86 PID 2856 wrote to memory of 2844 2856 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 87 PID 2844 wrote to memory of 1756 2844 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 88 PID 1756 wrote to memory of 4512 1756 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 89 PID 4512 wrote to memory of 680 4512 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 90 PID 680 wrote to memory of 4892 680 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 91 PID 4892 wrote to memory of 4488 4892 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 92 PID 4488 wrote to memory of 2700 4488 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 93 PID 2700 wrote to memory of 2868 2700 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 94 PID 2868 wrote to memory of 4156 2868 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 95 PID 4156 wrote to memory of 3984 4156 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 96 PID 3984 wrote to memory of 2128 3984 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 97 PID 2128 wrote to memory of 2620 2128 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 98 PID 2620 wrote to memory of 1656 2620 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 99 PID 1656 wrote to memory of 2192 1656 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 100 PID 2192 wrote to memory of 3428 2192 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 101 PID 3428 wrote to memory of 2044 3428 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 102 PID 2044 wrote to memory of 1316 2044 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 103 PID 1316 wrote to memory of 5024 1316 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 104 PID 5024 wrote to memory of 1216 5024 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 105 PID 1216 wrote to memory of 1820 1216 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 106 PID 1820 wrote to memory of 4100 1820 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 107 PID 4100 wrote to memory of 3436 4100 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 108 PID 3436 wrote to memory of 1368 3436 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 109 PID 1368 wrote to memory of 3372 1368 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 110 PID 3372 wrote to memory of 1728 3372 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 111 PID 1728 wrote to memory of 2120 1728 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 112 PID 2120 wrote to memory of 2440 2120 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 113 PID 2440 wrote to memory of 3196 2440 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 114 PID 3196 wrote to memory of 5072 3196 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 115 PID 5072 wrote to memory of 2592 5072 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 116 PID 2592 wrote to memory of 400 2592 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 117 PID 400 wrote to memory of 1924 400 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 118 PID 1924 wrote to memory of 796 1924 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 119 PID 796 wrote to memory of 3172 796 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 120 PID 3172 wrote to memory of 4492 3172 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 121 PID 4492 wrote to memory of 2232 4492 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 122 PID 2232 wrote to memory of 3512 2232 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 123 PID 3512 wrote to memory of 1868 3512 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 124 PID 1868 wrote to memory of 328 1868 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 125 PID 328 wrote to memory of 236 328 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 126 PID 236 wrote to memory of 2156 236 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 127 PID 2156 wrote to memory of 2608 2156 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 128 PID 2608 wrote to memory of 4904 2608 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 129 PID 4904 wrote to memory of 1128 4904 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 130 PID 1128 wrote to memory of 4604 1128 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 131 PID 4604 wrote to memory of 3136 4604 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 132 PID 3136 wrote to memory of 4664 3136 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 133 PID 4664 wrote to memory of 2464 4664 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 134 PID 2464 wrote to memory of 1168 2464 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 135 PID 1168 wrote to memory of 3724 1168 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 136 PID 3724 wrote to memory of 4884 3724 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 137 PID 4884 wrote to memory of 2520 4884 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 138 PID 2520 wrote to memory of 4028 2520 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 139 PID 4028 wrote to memory of 1912 4028 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 140 PID 1912 wrote to memory of 1768 1912 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 141 PID 1768 wrote to memory of 800 1768 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 142 PID 800 wrote to memory of 3456 800 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 143 PID 3456 wrote to memory of 4708 3456 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 144 PID 4708 wrote to memory of 1092 4708 2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa 145
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa66⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa67⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa68⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa69⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa70⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa71⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa72⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa73⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa74⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa75⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa76⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa77⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa78⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa79⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa80⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa81⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa82⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa83⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa84⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa85⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa86⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa87⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa88⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa89⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa90⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa91⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa92⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa93⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa94⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa95⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa96⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa97⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa98⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa99⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa100⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa101⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa102⤵PID:5248
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa103⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa104⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa105⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa106⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa107⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa108⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa109⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa110⤵PID:5376
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa111⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa112⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa113⤵PID:5424
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa114⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa115⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa116⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa117⤵PID:5488
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa118⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa119⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa120⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa121⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-02_b4c351cd2275eda45244dfd327a66587_akira_amadey_elex_rhadamanthys.usa122⤵PID:5568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-