Analysis
- max time kernel
26s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 18:06
Behavioral task
behavioral1
Sample
2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.exe
- Size 3.0MB
- Sample260808-wpvqesbm7v
- SHA256 cd1534f6699ff29aab13251bf96952bc37f0efdaeaf64da4901dec91440534ca
- MD5 2aabf93ef4b666cb8b07e066279840ce
- SHA1 1471cb52399790a0622b254ea7820ad7b1616432
- SHA512 dc26efd41b36fe43ebab2a29db4e6fdd79668aa2b8f442abb15975f110b0cebbacb7db984fe2269d94e6e8762aa888afbd186e385e8e823b75e713fb2d104c71
- SSDEEP 49152:CwxgGhqFybXsPLbutmkO+wAOInO4XrztygxLHkkwxgGhqFybXsPLbutmkO+wAOIU:CnybXsP+s+wE9XDVnybXsP+s+wE9XDU
- TLSH T1EDE5BE23F68080B9D552C170972A6A37B679B83807356ADB63C46F313E756D26F3DB02
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000d000000000426-3.dat family_shodi behavioral2/files/0x0004000000016cc3-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 3548 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 5080 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 5728 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 2256 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 6008 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 6012 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 4440 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 3264 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 1948 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 892 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 3432 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 1916 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 1668 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 472 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 1160 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 4400 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 5184 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 3792 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 4876 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 4732 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 5492 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 6040 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 3620 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 1600 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 264 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 256 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 4516 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 1096 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 2928 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 3004 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 5068 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 824 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 4288 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 5164 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 3728 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 4552 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 6084 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 1488 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 2372 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 4056 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 5708 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 5524 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 2180 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 3252 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 2708 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 2264 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 4104 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 2412 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 6036 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 5364 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 4180 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 912 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 1592 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 5876 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 4716 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 4908 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 5424 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 5948 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 3308 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 1908 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 5980 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 1660 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 1560 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 2696 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4592 wrote to memory of 3548 4592 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.exe 88 PID 3548 wrote to memory of 5080 3548 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 89 PID 5080 wrote to memory of 5728 5080 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 90 PID 5728 wrote to memory of 2256 5728 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 92 PID 2256 wrote to memory of 6008 2256 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 93 PID 6008 wrote to memory of 6012 6008 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 94 PID 6012 wrote to memory of 4440 6012 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 95 PID 4440 wrote to memory of 3264 4440 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 96 PID 3264 wrote to memory of 1948 3264 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 97 PID 1948 wrote to memory of 892 1948 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 98 PID 892 wrote to memory of 3432 892 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 99 PID 3432 wrote to memory of 1916 3432 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 100 PID 1916 wrote to memory of 1668 1916 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 101 PID 1668 wrote to memory of 472 1668 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 102 PID 472 wrote to memory of 1160 472 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 103 PID 1160 wrote to memory of 4400 1160 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 104 PID 4400 wrote to memory of 5184 4400 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 105 PID 5184 wrote to memory of 3792 5184 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 106 PID 3792 wrote to memory of 4876 3792 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 107 PID 4876 wrote to memory of 4732 4876 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 108 PID 4732 wrote to memory of 5492 4732 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 109 PID 5492 wrote to memory of 6040 5492 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 110 PID 6040 wrote to memory of 3620 6040 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 111 PID 3620 wrote to memory of 1600 3620 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 112 PID 1600 wrote to memory of 264 1600 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 113 PID 264 wrote to memory of 256 264 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 114 PID 256 wrote to memory of 4516 256 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 115 PID 4516 wrote to memory of 1096 4516 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 116 PID 1096 wrote to memory of 2928 1096 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 117 PID 2928 wrote to memory of 3004 2928 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 118 PID 3004 wrote to memory of 5068 3004 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 119 PID 5068 wrote to memory of 824 5068 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 120 PID 824 wrote to memory of 4288 824 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 121 PID 4288 wrote to memory of 5164 4288 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 122 PID 5164 wrote to memory of 3728 5164 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 123 PID 3728 wrote to memory of 4552 3728 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 124 PID 4552 wrote to memory of 6084 4552 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 125 PID 6084 wrote to memory of 1488 6084 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 126 PID 1488 wrote to memory of 2372 1488 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 127 PID 2372 wrote to memory of 4056 2372 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 128 PID 4056 wrote to memory of 5708 4056 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 129 PID 5708 wrote to memory of 5524 5708 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 130 PID 5524 wrote to memory of 2180 5524 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 131 PID 2180 wrote to memory of 3252 2180 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 132 PID 3252 wrote to memory of 2708 3252 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 133 PID 2708 wrote to memory of 2264 2708 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 134 PID 2264 wrote to memory of 4104 2264 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 135 PID 4104 wrote to memory of 2412 4104 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 136 PID 2412 wrote to memory of 6036 2412 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 137 PID 6036 wrote to memory of 5364 6036 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 138 PID 5364 wrote to memory of 4180 5364 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 139 PID 4180 wrote to memory of 912 4180 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 140 PID 912 wrote to memory of 1592 912 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 141 PID 1592 wrote to memory of 5876 1592 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 142 PID 5876 wrote to memory of 4716 5876 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 143 PID 4716 wrote to memory of 4908 4716 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 144 PID 4908 wrote to memory of 5424 4908 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 145 PID 5424 wrote to memory of 5948 5424 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 146 PID 5948 wrote to memory of 3308 5948 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 147 PID 3308 wrote to memory of 1908 3308 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 148 PID 1908 wrote to memory of 5980 1908 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 149 PID 5980 wrote to memory of 1660 5980 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 150 PID 1660 wrote to memory of 1560 1660 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 151 PID 1560 wrote to memory of 2696 1560 2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa66⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa67⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa68⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa69⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa70⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa71⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa72⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa73⤵
- System Location Discovery: System Language Discovery
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa74⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa75⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa76⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa77⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa78⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa79⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa80⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa81⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa82⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa83⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa84⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa85⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa86⤵PID:5776
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa87⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa88⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa89⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa90⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa91⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa92⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa93⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa94⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa95⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa96⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa97⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa98⤵
- System Location Discovery: System Language Discovery
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa99⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa100⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa101⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa102⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa103⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa104⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa105⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa106⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa107⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa108⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa109⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa110⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa111⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa112⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa113⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa114⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa115⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa116⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa117⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa118⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa119⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa120⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa121⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-08_2aabf93ef4b666cb8b07e066279840ce_akira_elex_rhadamanthys.usa122⤵
- System Location Discovery: System Language Discovery
PID:3448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-