Analysis
- max time kernel
33s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 18:05
Behavioral task
behavioral1
Sample
2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.exe
- Size 1.5MB
- Sample260720-wpb83saw3q
- SHA256 74142352c520b05f22afcb445738c4349625563170a2e994982a8d7af107b07e
- MD5 1cbf878d8c7550a95f3513125903b5cc
- SHA1 92ae4aec5322e4014f6d0da3a3feb3157c79b085
- SHA512 7c49d0121449aa9aaf7909ffa656abd6cb9fd21a9d2b79af324ed1b10fc4a12727fbea635b86da82cb82faa34071b65ad1c2f2c933512b93e56ff060e8e9c5a8
- SSDEEP 12288:BYixUrHGQVL9vwf+SqwLa8Cck39XYSNV+/MYixUrHGQVL9vwf+SqwLa8Cck39XYo:xxal9vGhqF3Ky+Qxal9vGhqF3Ky+W
- TLSH T1FF755A53F69910F8D05AD178974AA536FA72B84907317AEF1780AB313E76BE06B3D700
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x00150000000118ee-3.dat family_shodi behavioral2/files/0x000c00000001c56e-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 4484 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 4116 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 4740 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6520 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 2412 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 1720 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6604 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 916 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6164 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 4784 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6772 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6468 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6636 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6272 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6304 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6816 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6624 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6460 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 1076 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6524 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6988 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6736 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6372 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 2668 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 4400 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 4368 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 2728 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 1512 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 1316 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6184 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6200 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6196 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6516 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 2940 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6960 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6764 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 1152 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 3644 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6972 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6536 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6672 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 1352 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6204 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 7040 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6128 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 5956 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6620 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 5948 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 2720 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 608 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 5124 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 3440 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6908 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6916 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 4080 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 1192 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6572 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6592 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6732 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 1616 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6952 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6720 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6284 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 6776 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.exe - Drops file in Program Files directory 5 IoCs
description ioc Process File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5816 wrote to memory of 4484 5816 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.exe 90 PID 4484 wrote to memory of 4116 4484 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 91 PID 4116 wrote to memory of 4740 4116 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 92 PID 4740 wrote to memory of 6520 4740 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 93 PID 6520 wrote to memory of 2412 6520 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 94 PID 2412 wrote to memory of 1720 2412 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 95 PID 1720 wrote to memory of 6604 1720 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 96 PID 6604 wrote to memory of 916 6604 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 97 PID 916 wrote to memory of 6164 916 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 98 PID 6164 wrote to memory of 4784 6164 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 99 PID 4784 wrote to memory of 6772 4784 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 100 PID 6772 wrote to memory of 6468 6772 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 101 PID 6468 wrote to memory of 6636 6468 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 102 PID 6636 wrote to memory of 6272 6636 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 103 PID 6272 wrote to memory of 6304 6272 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 104 PID 6304 wrote to memory of 6816 6304 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 105 PID 6816 wrote to memory of 6624 6816 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 106 PID 6624 wrote to memory of 6460 6624 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 107 PID 6460 wrote to memory of 1076 6460 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 108 PID 1076 wrote to memory of 6524 1076 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 109 PID 6524 wrote to memory of 6988 6524 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 110 PID 6988 wrote to memory of 6736 6988 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 111 PID 6736 wrote to memory of 6372 6736 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 112 PID 6372 wrote to memory of 2668 6372 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 113 PID 2668 wrote to memory of 4400 2668 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 114 PID 4400 wrote to memory of 4368 4400 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 115 PID 4368 wrote to memory of 2728 4368 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 116 PID 2728 wrote to memory of 1512 2728 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 117 PID 1512 wrote to memory of 1316 1512 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 118 PID 1316 wrote to memory of 6184 1316 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 119 PID 6184 wrote to memory of 6200 6184 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 120 PID 6200 wrote to memory of 6196 6200 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 121 PID 6196 wrote to memory of 6516 6196 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 122 PID 6516 wrote to memory of 2940 6516 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 123 PID 2940 wrote to memory of 6960 2940 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 124 PID 6960 wrote to memory of 6764 6960 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 125 PID 6764 wrote to memory of 1152 6764 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 126 PID 1152 wrote to memory of 3644 1152 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 127 PID 3644 wrote to memory of 6972 3644 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 128 PID 6972 wrote to memory of 6536 6972 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 129 PID 6536 wrote to memory of 6672 6536 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 130 PID 6672 wrote to memory of 1352 6672 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 131 PID 1352 wrote to memory of 6204 1352 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 132 PID 6204 wrote to memory of 7040 6204 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 133 PID 7040 wrote to memory of 6128 7040 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 134 PID 6128 wrote to memory of 5956 6128 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 135 PID 5956 wrote to memory of 6620 5956 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 136 PID 6620 wrote to memory of 5948 6620 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 137 PID 5948 wrote to memory of 2720 5948 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 138 PID 2720 wrote to memory of 608 2720 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 139 PID 608 wrote to memory of 5124 608 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 140 PID 5124 wrote to memory of 3440 5124 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 141 PID 3440 wrote to memory of 6908 3440 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 142 PID 6908 wrote to memory of 6916 6908 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 143 PID 6916 wrote to memory of 4080 6916 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 144 PID 4080 wrote to memory of 1192 4080 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 145 PID 1192 wrote to memory of 6572 1192 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 146 PID 6572 wrote to memory of 6592 6572 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 147 PID 6592 wrote to memory of 6732 6592 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 148 PID 6732 wrote to memory of 1616 6732 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 149 PID 1616 wrote to memory of 6952 1616 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 150 PID 6952 wrote to memory of 6720 6952 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 151 PID 6720 wrote to memory of 6284 6720 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 152 PID 6284 wrote to memory of 6776 6284 2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6520 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6604 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6164 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6772 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6468 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6636 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6272 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6304 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6816 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6624 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6460 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6524 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6988 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6736 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6372 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6184 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6200 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6196 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6516 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6960 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6764 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6972 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6536 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6672 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6204 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7040 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6620 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6908 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6916 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6572 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6592 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6732 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6952 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6720 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6284 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:6776 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa66⤵PID:6380
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa67⤵PID:6352
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa68⤵PID:6928
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa69⤵PID:7052
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa70⤵PID:6820
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa71⤵PID:6892
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa72⤵PID:6884
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa73⤵PID:6888
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa74⤵PID:7028
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa75⤵PID:7036
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa76⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa77⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa78⤵PID:5424
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa79⤵
- System Location Discovery: System Language Discovery
PID:7084 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa80⤵PID:7068
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa81⤵PID:7148
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa82⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa83⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa84⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa85⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa86⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa87⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa88⤵PID:260
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa89⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa90⤵
- System Location Discovery: System Language Discovery
PID:940 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa91⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa92⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa93⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa94⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa95⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa96⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa97⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa98⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa99⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa100⤵PID:6748
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa101⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa102⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa103⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa104⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa105⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa106⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa107⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa108⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa109⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa110⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa111⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa112⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa113⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa114⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa115⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa116⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa117⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa118⤵PID:6984
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa119⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa120⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa121⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-20_1cbf878d8c7550a95f3513125903b5cc_akira_elex_rhadamanthys.usa122⤵PID:7092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-