Analysis
- max time kernel
51s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 16:14
Behavioral task
behavioral1
Sample
2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.exe
- Size 4.0MB
- Sample260804-tp164ade48
- SHA256 a1f361dffe5c0310e0af46b30e97a4d5289cc5d61daa5051cec179dd6fc05c7a
- MD5 32a53466991125da37e60a71712dd1dc
- SHA1 9e88e1d00eb4e4a94acab5d35938acff14bd54dd
- SHA512 404745463b91064eff22b1b73b678c8af42b431b4d0568a7e4704d6575199a978968e95c8ee61c5429656283292b32c404343a297800e63b68f68c5854a6ccfe
- SSDEEP 49152:xxgGhqFU2887eIx/KCGZd0qgNEfgkwqsxgGhqFU2887eIx/KCGZd0qgNEfgkwqu:EU2kWDkBbU2kWDkBu
- TLSH T17E169F22F48382BCE449C0B9529DAF76E429B819073024D75BD4FE235EB27D11F3AB59
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 1 IoCs
resource yara_rule behavioral1/files/0x00180000000243ca-3.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 4472 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2224 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4304 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1956 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1996 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2940 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1872 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3832 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 764 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3132 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1036 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4432 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4588 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2016 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2040 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4192 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 64 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3460 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1196 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4572 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2200 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4468 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3540 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2840 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3136 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2232 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1192 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2500 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2588 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4200 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4144 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2032 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4504 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4492 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2456 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2576 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3816 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4692 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 5012 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2504 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1736 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1456 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4396 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3228 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3740 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4124 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3304 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2160 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 212 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3860 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1488 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4596 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2520 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3948 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 844 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4000 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4004 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4832 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1276 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4516 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1364 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1732 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4700 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 732 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa - Drops file in Program Files directory 39 IoCs
description ioc Process File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.usa 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File created \??\c:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.usa 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.usa 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.usa 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.usa 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.usa 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaw.usa 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification \??\c:\Program Files\7-Zip\Uninstall.usa 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.usa 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File created \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.usa 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File created \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.usa 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File created \??\c:\Program Files\7-Zip\7zG.exe 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.usa 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.usa 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.usa 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3936 wrote to memory of 4472 3936 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.exe 86 PID 4472 wrote to memory of 2224 4472 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 87 PID 2224 wrote to memory of 4304 2224 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 88 PID 4304 wrote to memory of 1956 4304 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 89 PID 1956 wrote to memory of 1996 1956 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 90 PID 1996 wrote to memory of 2940 1996 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 91 PID 2940 wrote to memory of 1872 2940 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 92 PID 1872 wrote to memory of 3832 1872 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 93 PID 3832 wrote to memory of 764 3832 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 94 PID 764 wrote to memory of 3132 764 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 95 PID 3132 wrote to memory of 1036 3132 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 96 PID 1036 wrote to memory of 4432 1036 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 97 PID 4432 wrote to memory of 4588 4432 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 98 PID 4588 wrote to memory of 2016 4588 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 99 PID 2016 wrote to memory of 2040 2016 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 100 PID 2040 wrote to memory of 4192 2040 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 101 PID 4192 wrote to memory of 64 4192 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 102 PID 64 wrote to memory of 3460 64 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 103 PID 3460 wrote to memory of 1196 3460 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 104 PID 1196 wrote to memory of 4572 1196 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 105 PID 4572 wrote to memory of 2200 4572 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 106 PID 2200 wrote to memory of 4468 2200 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 107 PID 4468 wrote to memory of 3540 4468 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 108 PID 3540 wrote to memory of 2840 3540 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 109 PID 2840 wrote to memory of 3136 2840 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 110 PID 3136 wrote to memory of 2232 3136 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 111 PID 2232 wrote to memory of 1192 2232 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 112 PID 1192 wrote to memory of 2500 1192 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 113 PID 2500 wrote to memory of 2588 2500 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 114 PID 2588 wrote to memory of 4200 2588 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 115 PID 4200 wrote to memory of 4144 4200 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 116 PID 4144 wrote to memory of 2032 4144 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 117 PID 2032 wrote to memory of 4504 2032 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 118 PID 4504 wrote to memory of 4492 4504 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 119 PID 4492 wrote to memory of 2456 4492 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 120 PID 2456 wrote to memory of 2576 2456 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 121 PID 2576 wrote to memory of 3816 2576 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 122 PID 3816 wrote to memory of 4692 3816 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 123 PID 4692 wrote to memory of 5012 4692 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 124 PID 5012 wrote to memory of 2504 5012 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 125 PID 2504 wrote to memory of 1736 2504 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 126 PID 1736 wrote to memory of 1456 1736 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 127 PID 1456 wrote to memory of 4396 1456 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 128 PID 4396 wrote to memory of 3228 4396 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 129 PID 3228 wrote to memory of 3740 3228 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 130 PID 3740 wrote to memory of 4124 3740 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 131 PID 4124 wrote to memory of 3304 4124 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 132 PID 3304 wrote to memory of 2160 3304 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 133 PID 2160 wrote to memory of 212 2160 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 134 PID 212 wrote to memory of 3860 212 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 135 PID 3860 wrote to memory of 1488 3860 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 136 PID 1488 wrote to memory of 4596 1488 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 137 PID 4596 wrote to memory of 2520 4596 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 138 PID 2520 wrote to memory of 3948 2520 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 139 PID 3948 wrote to memory of 844 3948 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 140 PID 844 wrote to memory of 4000 844 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 141 PID 4000 wrote to memory of 4004 4000 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 142 PID 4004 wrote to memory of 4832 4004 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 143 PID 4832 wrote to memory of 1276 4832 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 144 PID 1276 wrote to memory of 4516 1276 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 145 PID 4516 wrote to memory of 1364 4516 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 146 PID 1364 wrote to memory of 1732 1364 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 147 PID 1732 wrote to memory of 4700 1732 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 148 PID 4700 wrote to memory of 732 4700 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:732 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa66⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa67⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa68⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa69⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa70⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa71⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa72⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa73⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa74⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa75⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa76⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa77⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa78⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa79⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa80⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa81⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa82⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa83⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa84⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa85⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa86⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa87⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa88⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa89⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa90⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa91⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa92⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa93⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa94⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa95⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa96⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa97⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa98⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa99⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa100⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa101⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa102⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa103⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa104⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa105⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa106⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa107⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa108⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa109⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa110⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa111⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa112⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa113⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa114⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa115⤵PID:5236
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa116⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa117⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa118⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa119⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa120⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa121⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa122⤵PID:5348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-