Analysis
- max time kernel
52s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/07/2026, 04:25
Behavioral task
behavioral1
Sample
2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe
- Size 2.4MB
- Sample260707-e13fzaey5n
- SHA256 0f2bd587a02fc8d5876d97a4eb361ae1b7f4a0afc6a03e05bf34bb3a2e0d4eeb
- MD5 370826a0151717742664ef8654a95832
- SHA1 b6d4f7708480580acaea7ad33df9af0f5ff1fa03
- SHA512 65de0b4c07ca9ffd29dc711001e50ebb4bd1ddbd18b0d4524526e15030e6ce7b740ed50b36346408170ee8b4d75ec2ac4ddd9dddc84cad0788bede521bf10819
- SSDEEP 24576:xxal9vGhqF3NWTktfCF1G0fHJxal9vGhqF3NWTktfCF1G0fH9:xxgGhqFwkwPxgGhqFwkwr
- TLSH T157C56C62F587837CD055C1B952DD9FB6E419BC2A032014D72FE4BE239DA17C21E3AB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral1/files/0x000c0000000242ac-2.dat family_shodi behavioral1/files/0x0008000000024597-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 4320 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4564 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4220 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3968 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4460 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4316 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 1864 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4392 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3796 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 1556 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4132 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4944 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4200 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4304 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2320 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2956 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 956 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3516 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4952 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2304 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4644 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 1224 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2392 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3900 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2692 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 5032 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3112 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3916 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3264 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3952 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4772 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3056 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 228 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 212 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2372 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3724 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4532 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 1364 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4712 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 1940 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4592 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 704 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2044 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 828 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3196 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4628 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4880 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2780 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 1132 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4064 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4556 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4724 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3704 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4940 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3220 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 1232 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 756 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2676 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3956 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 1548 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3668 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3684 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4872 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3348 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\7-Zip\7zG.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaw.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\misc.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaw.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaws.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.usa 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3832 wrote to memory of 4320 3832 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe 88 PID 4320 wrote to memory of 4564 4320 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 89 PID 4564 wrote to memory of 4220 4564 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 90 PID 4220 wrote to memory of 3968 4220 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 91 PID 3968 wrote to memory of 4460 3968 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 92 PID 4460 wrote to memory of 4316 4460 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 93 PID 4316 wrote to memory of 1864 4316 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 94 PID 1864 wrote to memory of 4392 1864 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 95 PID 4392 wrote to memory of 3796 4392 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 96 PID 3796 wrote to memory of 1556 3796 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 97 PID 1556 wrote to memory of 4132 1556 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 98 PID 4132 wrote to memory of 4944 4132 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 99 PID 4944 wrote to memory of 4200 4944 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 100 PID 4200 wrote to memory of 4304 4200 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 101 PID 4304 wrote to memory of 2320 4304 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 102 PID 2320 wrote to memory of 2956 2320 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 103 PID 2956 wrote to memory of 956 2956 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 104 PID 956 wrote to memory of 3516 956 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 105 PID 3516 wrote to memory of 4952 3516 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 106 PID 4952 wrote to memory of 2304 4952 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 107 PID 2304 wrote to memory of 4644 2304 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 108 PID 4644 wrote to memory of 1224 4644 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 109 PID 1224 wrote to memory of 2392 1224 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 110 PID 2392 wrote to memory of 3900 2392 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 111 PID 3900 wrote to memory of 2692 3900 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 112 PID 2692 wrote to memory of 5032 2692 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 113 PID 5032 wrote to memory of 3112 5032 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 114 PID 3112 wrote to memory of 3916 3112 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 115 PID 3916 wrote to memory of 3264 3916 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 116 PID 3264 wrote to memory of 3952 3264 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 117 PID 3952 wrote to memory of 4772 3952 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 118 PID 4772 wrote to memory of 3056 4772 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 119 PID 3056 wrote to memory of 228 3056 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 120 PID 228 wrote to memory of 212 228 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 121 PID 212 wrote to memory of 2372 212 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 122 PID 2372 wrote to memory of 3724 2372 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 123 PID 3724 wrote to memory of 4532 3724 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 124 PID 4532 wrote to memory of 1364 4532 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 125 PID 1364 wrote to memory of 4712 1364 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 126 PID 4712 wrote to memory of 1940 4712 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 127 PID 1940 wrote to memory of 4592 1940 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 128 PID 4592 wrote to memory of 704 4592 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 129 PID 704 wrote to memory of 2044 704 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 130 PID 2044 wrote to memory of 828 2044 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 131 PID 828 wrote to memory of 3196 828 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 132 PID 3196 wrote to memory of 4628 3196 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 133 PID 4628 wrote to memory of 4880 4628 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 134 PID 4880 wrote to memory of 2780 4880 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 135 PID 2780 wrote to memory of 1132 2780 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 136 PID 1132 wrote to memory of 4064 1132 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 137 PID 4064 wrote to memory of 4556 4064 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 138 PID 4556 wrote to memory of 4724 4556 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 139 PID 4724 wrote to memory of 3704 4724 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 140 PID 3704 wrote to memory of 4940 3704 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 141 PID 4940 wrote to memory of 3220 4940 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 142 PID 3220 wrote to memory of 1232 3220 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 143 PID 1232 wrote to memory of 756 1232 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 144 PID 756 wrote to memory of 2676 756 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 145 PID 2676 wrote to memory of 3956 2676 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 146 PID 3956 wrote to memory of 1548 3956 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 147 PID 1548 wrote to memory of 3668 1548 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 148 PID 3668 wrote to memory of 3684 3668 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 149 PID 3684 wrote to memory of 4872 3684 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 150 PID 4872 wrote to memory of 3348 4872 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa66⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa67⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa68⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa69⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa70⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa71⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa72⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa73⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa74⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa75⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa76⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa77⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa78⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa79⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa80⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa81⤵
- System Location Discovery: System Language Discovery
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa82⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa83⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa84⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa85⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa86⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa87⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa88⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa89⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa90⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa91⤵
- System Location Discovery: System Language Discovery
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa92⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa93⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa94⤵PID:5192
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa95⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa96⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa97⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa98⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa99⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa100⤵PID:5288
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa101⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa102⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa103⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa104⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa105⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa106⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa107⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa108⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa109⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa110⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa111⤵PID:5464
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa112⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa113⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa114⤵PID:5512
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa115⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa116⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa117⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa118⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa119⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa120⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa121⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa122⤵PID:5640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-