Analysis
- max time kernel
26s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 09:22
Behavioral task
behavioral1
Sample
2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.exe
- Size 1.3MB
- Sample260810-lb3trsfb86
- SHA256 ac48a3dd4c5f3ee471e95117e2eceb48e4bbd0089fdac0a91e44626bf7034a86
- MD5 f8c6e6ac067ad82793072f79ef65c8da
- SHA1 764e46d40d20187f598e4984a86d0b151c1fced9
- SHA512 2d557c4d9a103d359732b12cbecab09419ce24f848ba1f0f8f951c745c082add072e888f65959a0eb9b8fd2e1a12302e7b75528c08dbe3fbe31593cddd54c76b
- SSDEEP 12288:BYixUrHGQVL9vwf+SqwLa8Cck3HHT8YixUrHGQVL9vwf+SqwLa8Cck3HHT+:xxal9vGhqF3cxal9vGhqF3S
- TLSH T157557C57F69910FCD0AAC178935B6536B672B81907306AEF1780DB312E76BE06B3DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000f00000001b1d0-3.dat family_shodi behavioral2/files/0x000c00000001c5e5-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 980 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 3500 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 4628 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 2792 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 6108 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 2024 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 4232 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 3320 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 2660 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 6040 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 1108 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 2676 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 5124 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 2104 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 2648 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 1420 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 368 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 1628 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 6096 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 4804 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 2980 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 4512 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 3316 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 124 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 804 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 1984 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 4972 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 4320 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 6140 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 256 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 3360 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 3312 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 1220 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 5180 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 3088 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 4220 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 2796 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 4236 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 4196 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 4928 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 1872 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 2840 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 4560 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 1148 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 4392 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 6008 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 2276 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 5684 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 3036 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 3956 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 5512 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 3152 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 1132 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 2488 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 472 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 464 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 5840 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 3040 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 4752 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 5644 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 2552 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 1160 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 1748 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 5552 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 944 wrote to memory of 980 944 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.exe 88 PID 980 wrote to memory of 3500 980 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 89 PID 3500 wrote to memory of 4628 3500 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 90 PID 4628 wrote to memory of 2792 4628 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 91 PID 2792 wrote to memory of 6108 2792 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 92 PID 6108 wrote to memory of 2024 6108 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 93 PID 2024 wrote to memory of 4232 2024 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 94 PID 4232 wrote to memory of 3320 4232 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 95 PID 3320 wrote to memory of 2660 3320 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 96 PID 2660 wrote to memory of 6040 2660 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 97 PID 6040 wrote to memory of 1108 6040 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 98 PID 1108 wrote to memory of 2676 1108 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 99 PID 2676 wrote to memory of 5124 2676 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 100 PID 5124 wrote to memory of 2104 5124 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 101 PID 2104 wrote to memory of 2648 2104 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 102 PID 2648 wrote to memory of 1420 2648 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 103 PID 1420 wrote to memory of 368 1420 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 104 PID 368 wrote to memory of 1628 368 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 105 PID 1628 wrote to memory of 6096 1628 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 106 PID 6096 wrote to memory of 4804 6096 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 107 PID 4804 wrote to memory of 2980 4804 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 108 PID 2980 wrote to memory of 4512 2980 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 109 PID 4512 wrote to memory of 3316 4512 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 110 PID 3316 wrote to memory of 124 3316 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 111 PID 124 wrote to memory of 804 124 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 112 PID 804 wrote to memory of 1984 804 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 113 PID 1984 wrote to memory of 4972 1984 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 114 PID 4972 wrote to memory of 4320 4972 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 115 PID 4320 wrote to memory of 6140 4320 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 116 PID 6140 wrote to memory of 256 6140 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 117 PID 256 wrote to memory of 3360 256 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 118 PID 3360 wrote to memory of 3312 3360 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 119 PID 3312 wrote to memory of 1220 3312 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 120 PID 1220 wrote to memory of 5180 1220 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 121 PID 5180 wrote to memory of 3088 5180 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 122 PID 3088 wrote to memory of 4220 3088 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 123 PID 4220 wrote to memory of 2796 4220 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 124 PID 2796 wrote to memory of 4236 2796 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 125 PID 4236 wrote to memory of 4196 4236 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 126 PID 4196 wrote to memory of 4928 4196 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 127 PID 4928 wrote to memory of 1872 4928 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 128 PID 1872 wrote to memory of 2840 1872 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 129 PID 2840 wrote to memory of 4560 2840 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 130 PID 4560 wrote to memory of 1148 4560 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 131 PID 1148 wrote to memory of 4392 1148 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 132 PID 4392 wrote to memory of 6008 4392 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 133 PID 6008 wrote to memory of 2276 6008 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 134 PID 2276 wrote to memory of 5684 2276 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 135 PID 5684 wrote to memory of 3036 5684 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 136 PID 3036 wrote to memory of 3956 3036 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 137 PID 3956 wrote to memory of 5512 3956 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 138 PID 5512 wrote to memory of 3152 5512 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 139 PID 3152 wrote to memory of 1132 3152 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 140 PID 1132 wrote to memory of 2488 1132 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 141 PID 2488 wrote to memory of 472 2488 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 142 PID 472 wrote to memory of 464 472 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 143 PID 464 wrote to memory of 5840 464 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 144 PID 5840 wrote to memory of 3040 5840 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 145 PID 3040 wrote to memory of 4752 3040 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 146 PID 4752 wrote to memory of 5644 4752 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 147 PID 5644 wrote to memory of 2552 5644 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 148 PID 2552 wrote to memory of 1160 2552 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 149 PID 1160 wrote to memory of 1748 1160 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 150 PID 1748 wrote to memory of 5552 1748 2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa66⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa67⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa68⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa69⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa70⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa71⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa72⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa73⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa74⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa75⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa76⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa77⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa78⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa79⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa80⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa81⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa82⤵
- System Location Discovery: System Language Discovery
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa83⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa84⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa85⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa86⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa87⤵
- System Location Discovery: System Language Discovery
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa88⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa89⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa90⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa91⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa92⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa93⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa94⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa95⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa96⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa97⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa98⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa99⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa100⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa101⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa102⤵
- System Location Discovery: System Language Discovery
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa103⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa104⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa105⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa106⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa107⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa108⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa109⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa110⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa111⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa112⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa113⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa114⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa115⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa116⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa117⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa118⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa119⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa120⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa121⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-08-10_f8c6e6ac067ad82793072f79ef65c8da_akira_elex_rhadamanthys.usa122⤵PID:5668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-