Analysis
- max time kernel
39s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/07/2026, 12:47
Behavioral task
behavioral1
Sample
2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe
- Size 2.7MB
- Sample260727-p1kk9sseqe
- SHA256 3e2a7c91be12bea6811bfd675fa12da864723715bacda50eba568da7e46eb0b8
- MD5 cfc656bbef06b78b56be06651dd0e7f2
- SHA1 8904f971485567d57e8b0f486ab06a89c69b2bf6
- SHA512 78c63ee8b12f9a96042fc03338d8a4ab10333dae6b6c8c363a3eaf172e19a667cfbde2ff08efbe6794bd0e4ad0ad663ebd3535acb5cd0681f9d9b8064d90503c
- SSDEEP 49152:CwxgGhqFGbutmkO+wVbutmkO+whwxgGhqFGbutmkO+wVbutmkO+wM:CnLs+wos+whnLs+wos+wM
- TLSH T13BD5AD23F68160B9D646C330971A7531BBBAB83907319BDB67945F203EA56E06F3C352
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral1/files/0x00100000000231f3-2.dat family_shodi behavioral1/files/0x000700000002460c-69.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 4832 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5208 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2948 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5244 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4456 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5564 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 3772 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5672 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 1864 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 784 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 3192 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5196 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4328 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4240 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 936 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2268 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 1992 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5848 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 6024 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5500 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2284 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 972 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5160 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 1268 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5044 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4524 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 3060 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 6072 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 6096 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5904 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 3488 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 3564 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5340 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5052 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 3764 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 3744 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 1472 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2188 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 1660 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4352 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5224 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4228 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 1644 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 3580 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4336 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5960 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 1564 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2688 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2320 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4224 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5492 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2420 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2892 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 3852 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 3820 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4156 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 1232 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4452 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5844 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5168 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2404 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 3364 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4276 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 1076 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe - Drops file in Program Files directory 25 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.usa 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.usa 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.usa 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.usa 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.usa 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.usa 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.usa 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4752 wrote to memory of 4832 4752 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe 86 PID 4832 wrote to memory of 5208 4832 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 87 PID 5208 wrote to memory of 2948 5208 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 88 PID 2948 wrote to memory of 5244 2948 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 89 PID 5244 wrote to memory of 4456 5244 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 90 PID 4456 wrote to memory of 5564 4456 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 91 PID 5564 wrote to memory of 3772 5564 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 92 PID 3772 wrote to memory of 5672 3772 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 93 PID 5672 wrote to memory of 1864 5672 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 94 PID 1864 wrote to memory of 784 1864 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 95 PID 784 wrote to memory of 3192 784 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 96 PID 3192 wrote to memory of 5196 3192 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 97 PID 5196 wrote to memory of 4328 5196 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 98 PID 4328 wrote to memory of 4240 4328 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 99 PID 4240 wrote to memory of 936 4240 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 100 PID 936 wrote to memory of 2268 936 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 101 PID 2268 wrote to memory of 1992 2268 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 102 PID 1992 wrote to memory of 5848 1992 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 103 PID 5848 wrote to memory of 6024 5848 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 104 PID 6024 wrote to memory of 5500 6024 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 105 PID 5500 wrote to memory of 2284 5500 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 106 PID 2284 wrote to memory of 972 2284 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 107 PID 972 wrote to memory of 5160 972 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 108 PID 5160 wrote to memory of 1268 5160 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 109 PID 1268 wrote to memory of 5044 1268 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 110 PID 5044 wrote to memory of 4524 5044 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 111 PID 4524 wrote to memory of 3060 4524 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 112 PID 3060 wrote to memory of 6072 3060 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 113 PID 6072 wrote to memory of 6096 6072 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 114 PID 6096 wrote to memory of 5904 6096 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 115 PID 5904 wrote to memory of 3488 5904 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 116 PID 3488 wrote to memory of 3564 3488 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 117 PID 3564 wrote to memory of 5340 3564 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 118 PID 5340 wrote to memory of 5052 5340 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 119 PID 5052 wrote to memory of 3764 5052 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 120 PID 3764 wrote to memory of 3744 3764 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 121 PID 3744 wrote to memory of 1472 3744 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 122 PID 1472 wrote to memory of 2188 1472 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 123 PID 2188 wrote to memory of 1660 2188 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 124 PID 1660 wrote to memory of 4352 1660 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 125 PID 4352 wrote to memory of 5224 4352 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 126 PID 5224 wrote to memory of 4228 5224 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 127 PID 4228 wrote to memory of 1644 4228 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 128 PID 1644 wrote to memory of 3580 1644 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 129 PID 3580 wrote to memory of 4336 3580 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 130 PID 4336 wrote to memory of 5960 4336 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 131 PID 5960 wrote to memory of 1564 5960 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 132 PID 1564 wrote to memory of 2688 1564 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 133 PID 2688 wrote to memory of 2320 2688 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 134 PID 2320 wrote to memory of 4224 2320 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 135 PID 4224 wrote to memory of 5492 4224 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 136 PID 5492 wrote to memory of 2420 5492 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 137 PID 2420 wrote to memory of 2892 2420 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 138 PID 2892 wrote to memory of 3852 2892 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 139 PID 3852 wrote to memory of 3820 3852 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 140 PID 3820 wrote to memory of 4156 3820 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 141 PID 4156 wrote to memory of 1232 4156 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 142 PID 1232 wrote to memory of 4452 1232 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 143 PID 4452 wrote to memory of 5844 4452 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 144 PID 5844 wrote to memory of 5168 5844 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 145 PID 5168 wrote to memory of 2404 5168 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 146 PID 2404 wrote to memory of 3364 2404 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 147 PID 3364 wrote to memory of 4276 3364 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 148 PID 4276 wrote to memory of 1076 4276 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa66⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa67⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa68⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa69⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa70⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa71⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa72⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa73⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa74⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa75⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa76⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa77⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa78⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa79⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa80⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa81⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa82⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa83⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa84⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa85⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa86⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa87⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa88⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa89⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa90⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa91⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa92⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa93⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa94⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa95⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa96⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa97⤵
- System Location Discovery: System Language Discovery
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa98⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa99⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa100⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa101⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa102⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa103⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa104⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa105⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa106⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa107⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa108⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa109⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa110⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa111⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa112⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa113⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa114⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa115⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa116⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa117⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa118⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa119⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa120⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa121⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa122⤵PID:3448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-