Analysis
- max time kernel
25s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 02:04
Behavioral task
behavioral1
Sample
2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.exe
- Size 1.8MB
- Sample260701-chpfaaes8t
- SHA256 d780ab69702f7827d8cd45049d7f16eb6e5fd6e48dc3660b0d7bbcba87e304ec
- MD5 f45c6e76d0ba80aff60a36e8fa77be70
- SHA1 2cd88764387551365b3c76824b7d55e7b87bb879
- SHA512 79a20d1bf7ab10ce73a160617654a72d0a01b0e23af0a9a2b6baa2858906858ba8531f98509e5e711d577b9254d745a27b96f88e8f7dc8b1b7c2838cc011a5ad
- SSDEEP 24576:xxal9vGhqF3KD28ss87eIX7+H32xal9vGhqF3KD28ss87eIX7+H30:xxgGhqFU2887eI4GxgGhqFU2887eI4E
- TLSH T1A4858C03F68510F9E45AD235931E9A3ABA31B90947316EDB8780AF213F75BE06B3D744
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000700000001b85a-4.dat family_shodi behavioral2/files/0x000e00000001c4a6-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 3616 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 1564 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 5348 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 4808 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 5488 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 5624 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 3968 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 1652 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 2096 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 5484 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 5480 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 5060 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 4996 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 5892 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 2880 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 3260 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 2856 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 1060 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 2720 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 5608 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 5656 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 3456 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 1012 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 4388 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 4848 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 4840 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 4228 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 4776 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 3932 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 3128 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 2980 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 5788 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 1240 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 5024 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 4640 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 6024 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 1304 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 1484 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 1444 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 3004 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 1496 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 2876 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 4748 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 1400 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 2708 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 792 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 5388 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 1384 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 3908 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 568 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 936 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 1712 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 3132 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 5108 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 4844 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 5188 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 1940 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 260 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 248 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 3068 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 3140 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 1268 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 2944 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 2804 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4644 wrote to memory of 3616 4644 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.exe 87 PID 3616 wrote to memory of 1564 3616 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 88 PID 1564 wrote to memory of 5348 1564 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 89 PID 5348 wrote to memory of 4808 5348 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 90 PID 4808 wrote to memory of 5488 4808 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 91 PID 5488 wrote to memory of 5624 5488 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 92 PID 5624 wrote to memory of 3968 5624 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 93 PID 3968 wrote to memory of 1652 3968 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 94 PID 1652 wrote to memory of 2096 1652 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 95 PID 2096 wrote to memory of 5484 2096 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 96 PID 5484 wrote to memory of 5480 5484 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 97 PID 5480 wrote to memory of 5060 5480 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 98 PID 5060 wrote to memory of 4996 5060 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 99 PID 4996 wrote to memory of 5892 4996 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 100 PID 5892 wrote to memory of 2880 5892 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 101 PID 2880 wrote to memory of 3260 2880 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 102 PID 3260 wrote to memory of 2856 3260 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 103 PID 2856 wrote to memory of 1060 2856 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 104 PID 1060 wrote to memory of 2720 1060 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 105 PID 2720 wrote to memory of 5608 2720 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 106 PID 5608 wrote to memory of 5656 5608 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 107 PID 5656 wrote to memory of 3456 5656 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 108 PID 3456 wrote to memory of 1012 3456 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 109 PID 1012 wrote to memory of 4388 1012 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 110 PID 4388 wrote to memory of 4848 4388 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 111 PID 4848 wrote to memory of 4840 4848 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 112 PID 4840 wrote to memory of 4228 4840 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 113 PID 4228 wrote to memory of 4776 4228 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 114 PID 4776 wrote to memory of 3932 4776 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 115 PID 3932 wrote to memory of 3128 3932 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 116 PID 3128 wrote to memory of 2980 3128 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 117 PID 2980 wrote to memory of 5788 2980 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 118 PID 5788 wrote to memory of 1240 5788 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 119 PID 1240 wrote to memory of 5024 1240 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 120 PID 5024 wrote to memory of 4640 5024 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 121 PID 4640 wrote to memory of 6024 4640 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 122 PID 6024 wrote to memory of 1304 6024 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 123 PID 1304 wrote to memory of 1484 1304 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 124 PID 1484 wrote to memory of 1444 1484 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 125 PID 1444 wrote to memory of 3004 1444 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 126 PID 3004 wrote to memory of 1496 3004 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 127 PID 1496 wrote to memory of 2876 1496 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 128 PID 2876 wrote to memory of 4748 2876 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 129 PID 4748 wrote to memory of 1400 4748 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 130 PID 1400 wrote to memory of 2708 1400 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 131 PID 2708 wrote to memory of 792 2708 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 132 PID 792 wrote to memory of 5388 792 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 133 PID 5388 wrote to memory of 1384 5388 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 134 PID 1384 wrote to memory of 3908 1384 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 135 PID 3908 wrote to memory of 568 3908 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 136 PID 568 wrote to memory of 936 568 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 137 PID 936 wrote to memory of 1712 936 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 138 PID 1712 wrote to memory of 3132 1712 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 139 PID 3132 wrote to memory of 5108 3132 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 140 PID 5108 wrote to memory of 4844 5108 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 141 PID 4844 wrote to memory of 5188 4844 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 142 PID 5188 wrote to memory of 1940 5188 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 143 PID 1940 wrote to memory of 260 1940 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 144 PID 260 wrote to memory of 248 260 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 145 PID 248 wrote to memory of 3068 248 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 146 PID 3068 wrote to memory of 3140 3068 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 147 PID 3140 wrote to memory of 1268 3140 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 148 PID 1268 wrote to memory of 2944 1268 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 149 PID 2944 wrote to memory of 2804 2944 2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa66⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa67⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa68⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa69⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa70⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa71⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa72⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa73⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa74⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa75⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa76⤵
- System Location Discovery: System Language Discovery
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa77⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa78⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa79⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa80⤵
- System Location Discovery: System Language Discovery
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa81⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa82⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa83⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa84⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa85⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa86⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa87⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa88⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa89⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa90⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa91⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa92⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa93⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa94⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa95⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa96⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa97⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa98⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa99⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa100⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa101⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa102⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa103⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa104⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa105⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa106⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa107⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa108⤵
- System Location Discovery: System Language Discovery
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa109⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa110⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa111⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa112⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa113⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa114⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa115⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa116⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa117⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa118⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa119⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa120⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa121⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-06-30_f45c6e76d0ba80aff60a36e8fa77be70_akira_elex_rhadamanthys.usa122⤵
- System Location Discovery: System Language Discovery
PID:3272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-