Analysis
- max time kernel
28s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 04:25
Behavioral task
behavioral1
Sample
2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe
- Size 2.4MB
- Sample260707-e13fzaey5n
- SHA256 0f2bd587a02fc8d5876d97a4eb361ae1b7f4a0afc6a03e05bf34bb3a2e0d4eeb
- MD5 370826a0151717742664ef8654a95832
- SHA1 b6d4f7708480580acaea7ad33df9af0f5ff1fa03
- SHA512 65de0b4c07ca9ffd29dc711001e50ebb4bd1ddbd18b0d4524526e15030e6ce7b740ed50b36346408170ee8b4d75ec2ac4ddd9dddc84cad0788bede521bf10819
- SSDEEP 24576:xxal9vGhqF3NWTktfCF1G0fHJxal9vGhqF3NWTktfCF1G0fH9:xxgGhqFwkwPxgGhqFwkwr
- TLSH T157C56C62F587837CD055C1B952DD9FB6E419BC2A032014D72FE4BE239DA17C21E3AB29
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000900000001b2dd-3.dat family_shodi behavioral2/files/0x000d00000001c5b0-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 5012 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2872 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 6100 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2064 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 460 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4204 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4544 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4432 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3400 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2908 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3900 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4416 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 5916 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2372 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3912 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2452 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4120 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 952 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 1200 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3976 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3064 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 5136 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 1920 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2020 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 1796 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2044 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 1556 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 5100 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2080 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 880 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 5540 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 6076 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 260 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 248 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 1152 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3968 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3892 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 5976 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4080 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 5732 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3100 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2772 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 1740 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 5992 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 5096 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2012 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2276 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3856 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 824 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4624 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 5112 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4528 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 5036 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2204 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 5272 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 5140 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3216 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2820 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 752 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 2748 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 5208 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 1996 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 3552 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 4352 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3772 wrote to memory of 5012 3772 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe 87 PID 5012 wrote to memory of 2872 5012 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 88 PID 2872 wrote to memory of 6100 2872 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 89 PID 6100 wrote to memory of 2064 6100 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 90 PID 2064 wrote to memory of 460 2064 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 91 PID 460 wrote to memory of 4204 460 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 92 PID 4204 wrote to memory of 4544 4204 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 93 PID 4544 wrote to memory of 4432 4544 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 94 PID 4432 wrote to memory of 3400 4432 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 95 PID 3400 wrote to memory of 2908 3400 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 96 PID 2908 wrote to memory of 3900 2908 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 97 PID 3900 wrote to memory of 4416 3900 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 98 PID 4416 wrote to memory of 5916 4416 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 99 PID 5916 wrote to memory of 2372 5916 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 100 PID 2372 wrote to memory of 3912 2372 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 101 PID 3912 wrote to memory of 2452 3912 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 102 PID 2452 wrote to memory of 4120 2452 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 103 PID 4120 wrote to memory of 952 4120 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 104 PID 952 wrote to memory of 1200 952 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 105 PID 1200 wrote to memory of 3976 1200 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 106 PID 3976 wrote to memory of 3064 3976 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 107 PID 3064 wrote to memory of 5136 3064 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 108 PID 5136 wrote to memory of 1920 5136 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 109 PID 1920 wrote to memory of 2020 1920 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 110 PID 2020 wrote to memory of 1796 2020 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 111 PID 1796 wrote to memory of 2044 1796 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 112 PID 2044 wrote to memory of 1556 2044 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 113 PID 1556 wrote to memory of 5100 1556 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 114 PID 5100 wrote to memory of 2080 5100 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 115 PID 2080 wrote to memory of 880 2080 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 116 PID 880 wrote to memory of 5540 880 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 117 PID 5540 wrote to memory of 6076 5540 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 118 PID 6076 wrote to memory of 260 6076 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 119 PID 260 wrote to memory of 248 260 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 120 PID 248 wrote to memory of 1152 248 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 121 PID 1152 wrote to memory of 3968 1152 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 122 PID 3968 wrote to memory of 3892 3968 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 123 PID 3892 wrote to memory of 5976 3892 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 124 PID 5976 wrote to memory of 4080 5976 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 125 PID 4080 wrote to memory of 5732 4080 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 126 PID 5732 wrote to memory of 3100 5732 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 127 PID 3100 wrote to memory of 2772 3100 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 128 PID 2772 wrote to memory of 1740 2772 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 129 PID 1740 wrote to memory of 5992 1740 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 130 PID 5992 wrote to memory of 5096 5992 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 131 PID 5096 wrote to memory of 2012 5096 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 132 PID 2012 wrote to memory of 2276 2012 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 133 PID 2276 wrote to memory of 3856 2276 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 134 PID 3856 wrote to memory of 824 3856 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 135 PID 824 wrote to memory of 4624 824 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 136 PID 4624 wrote to memory of 5112 4624 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 137 PID 5112 wrote to memory of 4528 5112 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 138 PID 4528 wrote to memory of 5036 4528 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 139 PID 5036 wrote to memory of 2204 5036 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 140 PID 2204 wrote to memory of 5272 2204 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 141 PID 5272 wrote to memory of 5140 5272 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 142 PID 5140 wrote to memory of 3216 5140 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 143 PID 3216 wrote to memory of 2820 3216 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 144 PID 2820 wrote to memory of 752 2820 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 145 PID 752 wrote to memory of 2748 752 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 146 PID 2748 wrote to memory of 5208 2748 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 147 PID 5208 wrote to memory of 1996 5208 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 148 PID 1996 wrote to memory of 3552 1996 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 149 PID 3552 wrote to memory of 4352 3552 2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa66⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa67⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa68⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa69⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa70⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa71⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa72⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa73⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa74⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa75⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa76⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa77⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa78⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa79⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa80⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa81⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa82⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa83⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa84⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa85⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa86⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa87⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa88⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa89⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa90⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa91⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa92⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa93⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa94⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa95⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa96⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa97⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa98⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa99⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa100⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa101⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa102⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa103⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa104⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa105⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa106⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa107⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa108⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa109⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa110⤵
- System Location Discovery: System Language Discovery
PID:5328 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa111⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa112⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa113⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa114⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa115⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa116⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa117⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa118⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa119⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa120⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa121⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_370826a0151717742664ef8654a95832_akira_elex_rhadamanthys.usa122⤵PID:5244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-