Analysis
- max time kernel
58s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 11:33
Behavioral task
behavioral1
Sample
2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe
- Size 1.1MB
- Sample260808-npc7dadc54
- SHA256 6ca09b1418c50504c2c6963d68c936aafd1eae2b933cc143d28e7673b0b8f96d
- MD5 a8cd602913fc6116a6b2de978ffcf3fe
- SHA1 42d18f20a0453eddccdb236fb087e19a76aef959
- SHA512 e1fde490380731caaa8b94e7e91dd9e5ec48ab0a910fc5c262a44826a8474bfe02eb7c8642a1e4573a5fb16077d8aba713c44e571c0317f11becad394f402c3e
- SSDEEP 12288:PYixUrHGQVL9vwf+SqwLa8Cck3oJYixUrHGQVL9vwf+SqwLa8Cck3ov:jxal9vGhqF3Qxal9vGhqF3M
- TLSH T13E456B53F65910BCD49AC178835B6537BA72B84907317EEB1780AB312E7ABE06B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral1/files/0x001400000002433a-2.dat family_shodi behavioral1/files/0x00070000000244a7-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 4620 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4512 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2364 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3536 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2344 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4440 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3220 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2916 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2268 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2952 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4444 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4860 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2832 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3216 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4496 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2656 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1680 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1220 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3488 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 764 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3640 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4792 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3760 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1276 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2020 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4732 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 468 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4980 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3312 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4536 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2516 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3692 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3348 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1476 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3916 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4468 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3528 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4308 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1608 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4540 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1880 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 860 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1976 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 440 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1368 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1052 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3552 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4500 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2356 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 220 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4668 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2968 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1016 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1660 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 8 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1868 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4692 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3808 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3932 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3708 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2764 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3060 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2212 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2920 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaw.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CNFNOT32.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaws.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSREC.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javacpl.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\misc.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoev.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoia.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msotd.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4368 wrote to memory of 4620 4368 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe 84 PID 4620 wrote to memory of 4512 4620 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 85 PID 4512 wrote to memory of 2364 4512 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 86 PID 2364 wrote to memory of 3536 2364 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 87 PID 3536 wrote to memory of 2344 3536 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 88 PID 2344 wrote to memory of 4440 2344 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 89 PID 4440 wrote to memory of 3220 4440 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 90 PID 3220 wrote to memory of 2916 3220 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 91 PID 2916 wrote to memory of 2268 2916 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 92 PID 2268 wrote to memory of 2952 2268 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 93 PID 2952 wrote to memory of 4444 2952 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 94 PID 4444 wrote to memory of 4860 4444 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 95 PID 4860 wrote to memory of 2832 4860 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 96 PID 2832 wrote to memory of 3216 2832 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 97 PID 3216 wrote to memory of 4496 3216 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 98 PID 4496 wrote to memory of 2656 4496 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 99 PID 2656 wrote to memory of 1680 2656 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 100 PID 1680 wrote to memory of 1220 1680 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 101 PID 1220 wrote to memory of 3488 1220 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 102 PID 3488 wrote to memory of 764 3488 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 103 PID 764 wrote to memory of 3640 764 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 104 PID 3640 wrote to memory of 4792 3640 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 105 PID 4792 wrote to memory of 3760 4792 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 106 PID 3760 wrote to memory of 1276 3760 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 107 PID 1276 wrote to memory of 2020 1276 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 108 PID 2020 wrote to memory of 4732 2020 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 109 PID 4732 wrote to memory of 468 4732 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 110 PID 468 wrote to memory of 4980 468 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 111 PID 4980 wrote to memory of 3312 4980 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 112 PID 3312 wrote to memory of 4536 3312 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 113 PID 4536 wrote to memory of 2516 4536 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 114 PID 2516 wrote to memory of 3692 2516 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 115 PID 3692 wrote to memory of 3348 3692 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 116 PID 3348 wrote to memory of 1476 3348 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 117 PID 1476 wrote to memory of 3916 1476 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 118 PID 3916 wrote to memory of 4468 3916 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 119 PID 4468 wrote to memory of 3528 4468 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 120 PID 3528 wrote to memory of 4308 3528 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 121 PID 4308 wrote to memory of 1608 4308 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 122 PID 1608 wrote to memory of 4540 1608 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 123 PID 4540 wrote to memory of 1880 4540 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 124 PID 1880 wrote to memory of 860 1880 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 125 PID 860 wrote to memory of 1976 860 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 126 PID 1976 wrote to memory of 440 1976 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 127 PID 440 wrote to memory of 1368 440 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 128 PID 1368 wrote to memory of 1052 1368 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 129 PID 1052 wrote to memory of 3552 1052 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 130 PID 3552 wrote to memory of 4500 3552 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 131 PID 4500 wrote to memory of 2356 4500 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 132 PID 2356 wrote to memory of 220 2356 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 133 PID 220 wrote to memory of 4668 220 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 134 PID 4668 wrote to memory of 2968 4668 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 135 PID 2968 wrote to memory of 1016 2968 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 136 PID 1016 wrote to memory of 1660 1016 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 137 PID 1660 wrote to memory of 8 1660 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 138 PID 8 wrote to memory of 1868 8 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 139 PID 1868 wrote to memory of 4692 1868 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 140 PID 4692 wrote to memory of 3808 4692 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 141 PID 3808 wrote to memory of 3932 3808 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 142 PID 3932 wrote to memory of 3708 3932 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 143 PID 3708 wrote to memory of 2764 3708 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 144 PID 2764 wrote to memory of 3060 2764 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 145 PID 3060 wrote to memory of 2212 3060 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 146 PID 2212 wrote to memory of 2920 2212 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa66⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa67⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa68⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa69⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa70⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa71⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa72⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa73⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa74⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa75⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa76⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa77⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa78⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa79⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa80⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa81⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa82⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa83⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa84⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa85⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa86⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa87⤵
- System Location Discovery: System Language Discovery
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa88⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa89⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa90⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa91⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa92⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa93⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa94⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa95⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa96⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa97⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa98⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa99⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa100⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa101⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa102⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa103⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa104⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa105⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa106⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa107⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa108⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa109⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa110⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa111⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa112⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa113⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa114⤵PID:5248
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa115⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa116⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa117⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa118⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa119⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa120⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa121⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa122⤵PID:5376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-