Analysis
- max time kernel
25s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 16:14
Behavioral task
behavioral1
Sample
2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.exe
- Size 4.0MB
- Sample260804-tp164ade48
- SHA256 a1f361dffe5c0310e0af46b30e97a4d5289cc5d61daa5051cec179dd6fc05c7a
- MD5 32a53466991125da37e60a71712dd1dc
- SHA1 9e88e1d00eb4e4a94acab5d35938acff14bd54dd
- SHA512 404745463b91064eff22b1b73b678c8af42b431b4d0568a7e4704d6575199a978968e95c8ee61c5429656283292b32c404343a297800e63b68f68c5854a6ccfe
- SSDEEP 49152:xxgGhqFU2887eIx/KCGZd0qgNEfgkwqsxgGhqFU2887eIx/KCGZd0qgNEfgkwqu:EU2kWDkBbU2kWDkBu
- TLSH T17E169F22F48382BCE449C0B9529DAF76E429B819073024D75BD4FE235EB27D11F3AB59
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000b000000011377-3.dat family_shodi behavioral2/files/0x000d00000001c586-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 1148 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3356 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1088 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2964 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1084 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3284 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4392 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 5924 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3680 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3528 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1484 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1972 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4300 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 5644 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 5572 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3420 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3192 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3452 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 6092 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4128 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1532 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4264 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3076 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4888 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4720 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 124 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 952 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3004 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 5200 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2904 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2504 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1528 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 5448 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2816 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2192 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 988 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4960 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4820 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3492 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 5128 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 5692 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 5056 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 432 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3380 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3440 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1864 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 5496 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 2376 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 6108 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 5064 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 5472 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 852 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3032 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4760 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4552 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 5944 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 5036 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1200 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 4664 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 5648 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 3288 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 5852 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 5936 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 1080 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 1148 2648 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.exe 89 PID 1148 wrote to memory of 3356 1148 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 90 PID 3356 wrote to memory of 1088 3356 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 91 PID 1088 wrote to memory of 2964 1088 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 92 PID 2964 wrote to memory of 1084 2964 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 93 PID 1084 wrote to memory of 3284 1084 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 94 PID 3284 wrote to memory of 4392 3284 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 95 PID 4392 wrote to memory of 5924 4392 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 96 PID 5924 wrote to memory of 3680 5924 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 97 PID 3680 wrote to memory of 3528 3680 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 98 PID 3528 wrote to memory of 1484 3528 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 99 PID 1484 wrote to memory of 1972 1484 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 100 PID 1972 wrote to memory of 4300 1972 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 101 PID 4300 wrote to memory of 5644 4300 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 102 PID 5644 wrote to memory of 5572 5644 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 103 PID 5572 wrote to memory of 3420 5572 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 104 PID 3420 wrote to memory of 3192 3420 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 105 PID 3192 wrote to memory of 3452 3192 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 106 PID 3452 wrote to memory of 6092 3452 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 107 PID 6092 wrote to memory of 4128 6092 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 108 PID 4128 wrote to memory of 1532 4128 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 109 PID 1532 wrote to memory of 4264 1532 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 110 PID 4264 wrote to memory of 3076 4264 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 111 PID 3076 wrote to memory of 4888 3076 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 112 PID 4888 wrote to memory of 4720 4888 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 113 PID 4720 wrote to memory of 124 4720 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 114 PID 124 wrote to memory of 952 124 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 115 PID 952 wrote to memory of 3004 952 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 116 PID 3004 wrote to memory of 5200 3004 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 117 PID 5200 wrote to memory of 2904 5200 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 118 PID 2904 wrote to memory of 2504 2904 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 119 PID 2504 wrote to memory of 1528 2504 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 120 PID 1528 wrote to memory of 5448 1528 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 121 PID 5448 wrote to memory of 2816 5448 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 122 PID 2816 wrote to memory of 2192 2816 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 123 PID 2192 wrote to memory of 988 2192 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 124 PID 988 wrote to memory of 4960 988 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 125 PID 4960 wrote to memory of 4820 4960 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 126 PID 4820 wrote to memory of 3492 4820 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 127 PID 3492 wrote to memory of 5128 3492 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 128 PID 5128 wrote to memory of 5692 5128 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 129 PID 5692 wrote to memory of 5056 5692 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 130 PID 5056 wrote to memory of 432 5056 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 131 PID 432 wrote to memory of 3380 432 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 132 PID 3380 wrote to memory of 3440 3380 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 133 PID 3440 wrote to memory of 1864 3440 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 134 PID 1864 wrote to memory of 5496 1864 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 135 PID 5496 wrote to memory of 2376 5496 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 136 PID 2376 wrote to memory of 6108 2376 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 137 PID 6108 wrote to memory of 5064 6108 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 138 PID 5064 wrote to memory of 5472 5064 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 139 PID 5472 wrote to memory of 852 5472 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 140 PID 852 wrote to memory of 3032 852 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 141 PID 3032 wrote to memory of 4760 3032 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 142 PID 4760 wrote to memory of 4552 4760 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 143 PID 4552 wrote to memory of 5944 4552 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 144 PID 5944 wrote to memory of 5036 5944 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 145 PID 5036 wrote to memory of 1200 5036 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 146 PID 1200 wrote to memory of 4664 1200 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 147 PID 4664 wrote to memory of 5648 4664 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 148 PID 5648 wrote to memory of 3288 5648 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 149 PID 3288 wrote to memory of 5852 3288 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 150 PID 5852 wrote to memory of 5936 5852 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 151 PID 5936 wrote to memory of 1080 5936 2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa66⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa67⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa68⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa69⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa70⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa71⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa72⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa73⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa74⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa75⤵
- System Location Discovery: System Language Discovery
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa76⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa77⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa78⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa79⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa80⤵
- System Location Discovery: System Language Discovery
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa81⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa82⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa83⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa84⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa85⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa86⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa87⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa88⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa89⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa90⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa91⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa92⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa93⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa94⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa95⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa96⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa97⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa98⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa99⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa100⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa101⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa102⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa103⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa104⤵
- System Location Discovery: System Language Discovery
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa105⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa106⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa107⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa108⤵
- System Location Discovery: System Language Discovery
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa109⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa110⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa111⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa112⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa113⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa114⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa115⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa116⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa117⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa118⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa119⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa120⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa121⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-04_32a53466991125da37e60a71712dd1dc_akira_elex_rhadamanthys.usa122⤵PID:4832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-