Analysis
- max time kernel
31s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 11:33
Behavioral task
behavioral1
Sample
2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe
- Size 1.1MB
- Sample260808-npc7dadc54
- SHA256 6ca09b1418c50504c2c6963d68c936aafd1eae2b933cc143d28e7673b0b8f96d
- MD5 a8cd602913fc6116a6b2de978ffcf3fe
- SHA1 42d18f20a0453eddccdb236fb087e19a76aef959
- SHA512 e1fde490380731caaa8b94e7e91dd9e5ec48ab0a910fc5c262a44826a8474bfe02eb7c8642a1e4573a5fb16077d8aba713c44e571c0317f11becad394f402c3e
- SSDEEP 12288:PYixUrHGQVL9vwf+SqwLa8Cck3oJYixUrHGQVL9vwf+SqwLa8Cck3ov:jxal9vGhqF3Qxal9vGhqF3M
- TLSH T13E456B53F65910BCD49AC178835B6537BA72B84907317EEB1780AB312E7ABE06B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x0011000000019a98-3.dat family_shodi behavioral2/files/0x000e00000001c5ac-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 4820 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3572 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 5724 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3784 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4464 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2712 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3628 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 5984 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3804 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 5884 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1720 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3796 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4432 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4604 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4828 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2616 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4784 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 5980 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4928 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3752 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4064 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4092 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1248 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1284 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3708 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 6044 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2464 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4876 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1080 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 5048 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2996 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4908 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1908 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 5996 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2752 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1416 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4728 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4332 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1132 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2952 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2296 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4324 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 5672 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1768 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 752 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4472 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1628 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3332 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3392 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4448 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3404 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2140 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 5928 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 6040 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 784 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4824 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3480 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2608 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2180 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 1884 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 3648 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 4840 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 2588 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 5552 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3452 wrote to memory of 4820 3452 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe 88 PID 4820 wrote to memory of 3572 4820 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 89 PID 3572 wrote to memory of 5724 3572 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 90 PID 5724 wrote to memory of 3784 5724 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 91 PID 3784 wrote to memory of 4464 3784 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 92 PID 4464 wrote to memory of 2712 4464 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 93 PID 2712 wrote to memory of 3628 2712 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 94 PID 3628 wrote to memory of 5984 3628 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 95 PID 5984 wrote to memory of 3804 5984 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 96 PID 3804 wrote to memory of 5884 3804 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 97 PID 5884 wrote to memory of 1720 5884 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 98 PID 1720 wrote to memory of 3796 1720 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 99 PID 3796 wrote to memory of 4432 3796 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 100 PID 4432 wrote to memory of 4604 4432 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 101 PID 4604 wrote to memory of 4828 4604 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 102 PID 4828 wrote to memory of 2616 4828 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 103 PID 2616 wrote to memory of 4784 2616 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 104 PID 4784 wrote to memory of 5980 4784 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 105 PID 5980 wrote to memory of 4928 5980 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 106 PID 4928 wrote to memory of 3752 4928 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 107 PID 3752 wrote to memory of 4064 3752 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 108 PID 4064 wrote to memory of 4092 4064 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 109 PID 4092 wrote to memory of 1248 4092 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 110 PID 1248 wrote to memory of 1284 1248 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 111 PID 1284 wrote to memory of 3708 1284 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 112 PID 3708 wrote to memory of 6044 3708 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 113 PID 6044 wrote to memory of 2464 6044 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 114 PID 2464 wrote to memory of 4876 2464 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 115 PID 4876 wrote to memory of 1080 4876 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 116 PID 1080 wrote to memory of 5048 1080 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 117 PID 5048 wrote to memory of 2996 5048 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 118 PID 2996 wrote to memory of 4908 2996 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 119 PID 4908 wrote to memory of 1908 4908 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 120 PID 1908 wrote to memory of 5996 1908 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 121 PID 5996 wrote to memory of 2752 5996 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 122 PID 2752 wrote to memory of 1416 2752 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 123 PID 1416 wrote to memory of 4728 1416 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 124 PID 4728 wrote to memory of 4332 4728 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 125 PID 4332 wrote to memory of 1132 4332 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 126 PID 1132 wrote to memory of 2952 1132 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 127 PID 2952 wrote to memory of 2296 2952 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 128 PID 2296 wrote to memory of 4324 2296 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 129 PID 4324 wrote to memory of 5672 4324 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 130 PID 5672 wrote to memory of 1768 5672 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 131 PID 1768 wrote to memory of 752 1768 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 132 PID 752 wrote to memory of 4472 752 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 133 PID 4472 wrote to memory of 1628 4472 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 134 PID 1628 wrote to memory of 3332 1628 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 135 PID 3332 wrote to memory of 3392 3332 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 136 PID 3392 wrote to memory of 4448 3392 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 137 PID 4448 wrote to memory of 3404 4448 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 138 PID 3404 wrote to memory of 2140 3404 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 139 PID 2140 wrote to memory of 5928 2140 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 140 PID 5928 wrote to memory of 6040 5928 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 141 PID 6040 wrote to memory of 784 6040 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 142 PID 784 wrote to memory of 4824 784 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 143 PID 4824 wrote to memory of 3480 4824 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 144 PID 3480 wrote to memory of 2608 3480 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 145 PID 2608 wrote to memory of 2180 2608 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 146 PID 2180 wrote to memory of 1884 2180 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 147 PID 1884 wrote to memory of 3648 1884 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 148 PID 3648 wrote to memory of 4840 3648 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 149 PID 4840 wrote to memory of 2588 4840 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 150 PID 2588 wrote to memory of 5552 2588 2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa66⤵
- System Location Discovery: System Language Discovery
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa67⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa68⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa69⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa70⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa71⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa72⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa73⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa74⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa75⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa76⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa77⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa78⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa79⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa80⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa81⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa82⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa83⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa84⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa85⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa86⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa87⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa88⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa89⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa90⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa91⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa92⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa93⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa94⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa95⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa96⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa97⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa98⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa99⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa100⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa101⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa102⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa103⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa104⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa105⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa106⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa107⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa108⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa109⤵PID:5376
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa110⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa111⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa112⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa113⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa114⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa115⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa116⤵
- System Location Discovery: System Language Discovery
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa117⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa118⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa119⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa120⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa121⤵PID:6148
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_a8cd602913fc6116a6b2de978ffcf3fe_akira_elex_rhadamanthys.usa122⤵PID:6164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-