Analysis
- max time kernel
21s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 12:47
Behavioral task
behavioral1
Sample
2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe
- Size 2.7MB
- Sample260727-p1kk9sseqe
- SHA256 3e2a7c91be12bea6811bfd675fa12da864723715bacda50eba568da7e46eb0b8
- MD5 cfc656bbef06b78b56be06651dd0e7f2
- SHA1 8904f971485567d57e8b0f486ab06a89c69b2bf6
- SHA512 78c63ee8b12f9a96042fc03338d8a4ab10333dae6b6c8c363a3eaf172e19a667cfbde2ff08efbe6794bd0e4ad0ad663ebd3535acb5cd0681f9d9b8064d90503c
- SSDEEP 49152:CwxgGhqFGbutmkO+wVbutmkO+whwxgGhqFGbutmkO+wVbutmkO+wM:CnLs+wos+whnLs+wos+wM
- TLSH T13BD5AD23F68160B9D646C330971A7531BBBAB83907319BDB67945F203EA56E06F3C352
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000d00000001b87d-3.dat family_shodi behavioral2/files/0x000d00000001c4cd-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 5812 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4896 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5440 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2936 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2920 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 1856 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 1200 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4100 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5736 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4216 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5384 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2500 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4156 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5916 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 1548 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2792 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 3124 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4144 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4640 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5616 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5452 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2424 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 3492 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4984 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2108 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 932 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5000 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 3192 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 3128 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4140 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5788 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2380 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5924 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4748 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4836 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 6108 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4592 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5912 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 3748 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2604 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2052 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5880 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5588 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4988 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 1696 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2152 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4260 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 5496 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4304 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 1204 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 596 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 556 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2640 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2848 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4424 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2644 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 3728 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 3792 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 716 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2656 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 6140 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 4876 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 1676 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 2440 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5676 wrote to memory of 5812 5676 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe 89 PID 5812 wrote to memory of 4896 5812 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 90 PID 4896 wrote to memory of 5440 4896 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 91 PID 5440 wrote to memory of 2936 5440 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 92 PID 2936 wrote to memory of 2920 2936 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 93 PID 2920 wrote to memory of 1856 2920 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 94 PID 1856 wrote to memory of 1200 1856 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 95 PID 1200 wrote to memory of 4100 1200 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 96 PID 4100 wrote to memory of 5736 4100 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 97 PID 5736 wrote to memory of 4216 5736 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 98 PID 4216 wrote to memory of 5384 4216 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 99 PID 5384 wrote to memory of 2500 5384 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 100 PID 2500 wrote to memory of 4156 2500 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 101 PID 4156 wrote to memory of 5916 4156 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 102 PID 5916 wrote to memory of 1548 5916 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 103 PID 1548 wrote to memory of 2792 1548 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 104 PID 2792 wrote to memory of 3124 2792 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 105 PID 3124 wrote to memory of 4144 3124 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 106 PID 4144 wrote to memory of 4640 4144 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 107 PID 4640 wrote to memory of 5616 4640 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 108 PID 5616 wrote to memory of 5452 5616 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 109 PID 5452 wrote to memory of 2424 5452 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 110 PID 2424 wrote to memory of 3492 2424 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 111 PID 3492 wrote to memory of 4984 3492 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 112 PID 4984 wrote to memory of 2108 4984 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 113 PID 2108 wrote to memory of 932 2108 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 114 PID 932 wrote to memory of 5000 932 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 115 PID 5000 wrote to memory of 3192 5000 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 116 PID 3192 wrote to memory of 3128 3192 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 117 PID 3128 wrote to memory of 4140 3128 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 118 PID 4140 wrote to memory of 5788 4140 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 119 PID 5788 wrote to memory of 2380 5788 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 120 PID 2380 wrote to memory of 5924 2380 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 121 PID 5924 wrote to memory of 4748 5924 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 122 PID 4748 wrote to memory of 4836 4748 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 123 PID 4836 wrote to memory of 6108 4836 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 124 PID 6108 wrote to memory of 4592 6108 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 125 PID 4592 wrote to memory of 5912 4592 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 126 PID 5912 wrote to memory of 3748 5912 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 127 PID 3748 wrote to memory of 2604 3748 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 128 PID 2604 wrote to memory of 2052 2604 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 129 PID 2052 wrote to memory of 5880 2052 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 130 PID 5880 wrote to memory of 5588 5880 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 131 PID 5588 wrote to memory of 4988 5588 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 132 PID 4988 wrote to memory of 1696 4988 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 133 PID 1696 wrote to memory of 2152 1696 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 134 PID 2152 wrote to memory of 4260 2152 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 135 PID 4260 wrote to memory of 5496 4260 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 136 PID 5496 wrote to memory of 4304 5496 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 137 PID 4304 wrote to memory of 1204 4304 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 138 PID 1204 wrote to memory of 596 1204 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 139 PID 596 wrote to memory of 556 596 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 140 PID 556 wrote to memory of 2640 556 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 141 PID 2640 wrote to memory of 2848 2640 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 142 PID 2848 wrote to memory of 4424 2848 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 143 PID 4424 wrote to memory of 2644 4424 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 144 PID 2644 wrote to memory of 3728 2644 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 145 PID 3728 wrote to memory of 3792 3728 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 146 PID 3792 wrote to memory of 716 3792 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 147 PID 716 wrote to memory of 2656 716 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 148 PID 2656 wrote to memory of 6140 2656 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 149 PID 6140 wrote to memory of 4876 6140 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 150 PID 4876 wrote to memory of 1676 4876 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 151 PID 1676 wrote to memory of 2440 1676 2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa66⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa67⤵
- System Location Discovery: System Language Discovery
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa68⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa69⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa70⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa71⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa72⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa73⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa74⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa75⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa76⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa77⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa78⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa79⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa80⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa81⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa82⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa83⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa84⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa85⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa86⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa87⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa88⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa89⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa90⤵
- System Location Discovery: System Language Discovery
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa91⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa92⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa93⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa94⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa95⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa96⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa97⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa98⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa99⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa100⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa101⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa102⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa103⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa104⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa105⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa106⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa107⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa108⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa109⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa110⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa111⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa112⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa113⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa114⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa115⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa116⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa117⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa118⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa119⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa120⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa121⤵PID:120
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-27_cfc656bbef06b78b56be06651dd0e7f2_akira_elex_rhadamanthys.usa122⤵PID:5344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-