Analysis
- max time kernel
40s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 12:30
Behavioral task
behavioral1
Sample
2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe
- Size 1.4MB
- Sample260729-pprv7svanb
- SHA256 c88f9903581e1629766847b85044226e2751c0e505cdeedda1164f46e1e29bbe
- MD5 1d5d4692a7c6ba66102d98f9682f8bb1
- SHA1 d01187f39b82fe90b774e43e90bb695949415c63
- SHA512 eb512d0bde7031afa7ed2c2b504a49d4455201fa6e8bb8044c9d4f4213c1591397ccc59d066b36e68139fa6571d6b1100fcc710b5df25f0b31e19c7cf8362bf9
- SSDEEP 12288:/YixUrHGQVL9vwf+SqwLa8Cck39XGZ4qYixUrHGQVL9vwf+SqwLa8Cck39XGZ4C:Txal9vGhqF3Qxal9vGhqF3M
- TLSH T16A657C67F69510FCD0AAD178835B6536B672B81907316EEB1380E6312E7ABE06F3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000a000000019cb3-4.dat family_shodi behavioral2/files/0x000c00000001c569-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 4880 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 4536 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 1748 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 1712 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 3492 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 1100 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 1716 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 2572 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 5028 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 3008 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 5976 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 2536 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 4700 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 1496 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 4284 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 5044 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 3452 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 5800 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 1932 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 2940 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 4252 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 6032 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 2076 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 5848 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 5812 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 5064 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 1252 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 1568 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 3940 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 5964 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 2688 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 1244 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 4784 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 3812 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 8 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 4592 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 484 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 5020 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 4104 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 1276 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 5208 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 4608 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 1488 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 3112 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 1256 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 3020 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 3092 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 5256 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 4748 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 3568 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 852 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 5780 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 3384 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 2420 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 5312 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 1556 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 796 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 4440 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 704 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 4428 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 3972 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 3616 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 3544 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 5696 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe - Drops file in Program Files directory 21 IoCs
description ioc Process File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.usa 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.usa 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.usa 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.usa 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.usa 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4100 wrote to memory of 4880 4100 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe 89 PID 4880 wrote to memory of 4536 4880 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 90 PID 4536 wrote to memory of 1748 4536 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 91 PID 1748 wrote to memory of 1712 1748 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 92 PID 1712 wrote to memory of 3492 1712 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 93 PID 3492 wrote to memory of 1100 3492 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 94 PID 1100 wrote to memory of 1716 1100 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 95 PID 1716 wrote to memory of 2572 1716 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 96 PID 2572 wrote to memory of 5028 2572 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 97 PID 5028 wrote to memory of 3008 5028 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 98 PID 3008 wrote to memory of 5976 3008 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 99 PID 5976 wrote to memory of 2536 5976 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 100 PID 2536 wrote to memory of 4700 2536 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 101 PID 4700 wrote to memory of 1496 4700 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 102 PID 1496 wrote to memory of 4284 1496 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 103 PID 4284 wrote to memory of 5044 4284 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 104 PID 5044 wrote to memory of 3452 5044 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 105 PID 3452 wrote to memory of 5800 3452 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 106 PID 5800 wrote to memory of 1932 5800 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 107 PID 1932 wrote to memory of 2940 1932 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 108 PID 2940 wrote to memory of 4252 2940 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 109 PID 4252 wrote to memory of 6032 4252 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 110 PID 6032 wrote to memory of 2076 6032 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 111 PID 2076 wrote to memory of 5848 2076 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 112 PID 5848 wrote to memory of 5812 5848 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 113 PID 5812 wrote to memory of 5064 5812 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 114 PID 5064 wrote to memory of 1252 5064 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 115 PID 1252 wrote to memory of 1568 1252 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 116 PID 1568 wrote to memory of 3940 1568 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 117 PID 3940 wrote to memory of 5964 3940 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 118 PID 5964 wrote to memory of 2688 5964 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 119 PID 2688 wrote to memory of 1244 2688 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 120 PID 1244 wrote to memory of 4784 1244 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 121 PID 4784 wrote to memory of 3812 4784 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 122 PID 3812 wrote to memory of 8 3812 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 123 PID 8 wrote to memory of 4592 8 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 124 PID 4592 wrote to memory of 484 4592 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 125 PID 484 wrote to memory of 5020 484 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 126 PID 5020 wrote to memory of 4104 5020 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 127 PID 4104 wrote to memory of 1276 4104 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 128 PID 1276 wrote to memory of 5208 1276 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 129 PID 5208 wrote to memory of 4608 5208 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 130 PID 4608 wrote to memory of 1488 4608 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 131 PID 1488 wrote to memory of 3112 1488 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 132 PID 3112 wrote to memory of 1256 3112 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 133 PID 1256 wrote to memory of 3020 1256 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 134 PID 3020 wrote to memory of 3092 3020 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 135 PID 3092 wrote to memory of 5256 3092 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 136 PID 5256 wrote to memory of 4748 5256 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 137 PID 4748 wrote to memory of 3568 4748 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 138 PID 3568 wrote to memory of 852 3568 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 139 PID 852 wrote to memory of 5780 852 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 140 PID 5780 wrote to memory of 3384 5780 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 141 PID 3384 wrote to memory of 2420 3384 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 142 PID 2420 wrote to memory of 5312 2420 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 143 PID 5312 wrote to memory of 1556 5312 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 144 PID 1556 wrote to memory of 796 1556 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 145 PID 796 wrote to memory of 4440 796 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 146 PID 4440 wrote to memory of 704 4440 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 147 PID 704 wrote to memory of 4428 704 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 148 PID 4428 wrote to memory of 3972 4428 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 149 PID 3972 wrote to memory of 3616 3972 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 150 PID 3616 wrote to memory of 3544 3616 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 151 PID 3544 wrote to memory of 5696 3544 2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa66⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa67⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa68⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa69⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa70⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa71⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa72⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa73⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa74⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa75⤵
- System Location Discovery: System Language Discovery
PID:5544 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa76⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa77⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa78⤵
- System Location Discovery: System Language Discovery
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa79⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa80⤵
- System Location Discovery: System Language Discovery
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa81⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa82⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa83⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa84⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa85⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa86⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa87⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa88⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa89⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa90⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa91⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa92⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa93⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa94⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa95⤵
- System Location Discovery: System Language Discovery
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa96⤵PID:5508
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa97⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa98⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa99⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa100⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa101⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa102⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa103⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa104⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa105⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa106⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa107⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa108⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa109⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa110⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa111⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa112⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa113⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa114⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa115⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa116⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa117⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa118⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa119⤵PID:52
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa120⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa121⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-07-29_1d5d4692a7c6ba66102d98f9682f8bb1_akira_elex_rhadamanthys.usa122⤵PID:4196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-