Analysis
- max time kernel
24s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 00:11
Behavioral task
behavioral1
Sample
2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.exe
- Size 3.8MB
- Sample260910-agsp7st1a1
- SHA256 39b262b64c1b742736ca0fd1e1cdc2bbf71eecc4c6143c1570d148a1a8337718
- MD5 10feb306851c918abb21e065346604ef
- SHA1 709805419bc0720ec0e9bacff77e1bead3cc5cfe
- SHA512 824571865465859437d48807d6eb6f2b342bd8b01c43af0d20386d7f7adf7b0ce4e91071226f55326acc617aaf616dc43ec201703c3ead89ec155ade0800438a
- SSDEEP 49152:IxgGhqFU2887eR+Cq99LyHHI+t6O8N+ailabXsZxgGhqFU2887eR+Cq99LyHHI+O:vU2V0oAaVbXscU2V0oAaVbXsS
- TLSH T17C168D13F58500F9D04AC079935AAA36E936B8590B3479EF07809A623F77FE16B3DB05
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000600000001b86d-4.dat family_shodi behavioral2/files/0x000c00000001c5d7-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 3576 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 2128 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 4312 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 1808 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 1680 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 4292 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 2924 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 3668 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 1352 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 2312 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 2324 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 4104 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 4788 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 5260 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 3960 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 1264 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 4324 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 3428 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 2264 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 940 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 5772 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 5356 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 244 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 240 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 2488 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 4220 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 5724 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 6124 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 4428 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 2120 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 2096 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 5460 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 4296 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 1564 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 704 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 2984 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 3396 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 3404 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 4452 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 5196 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 1932 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 572 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 1532 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 5536 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 5552 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 3188 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 5976 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 5492 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 2000 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 944 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 2304 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 4268 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 4072 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 1228 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 1788 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 4308 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 4364 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 4992 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 3452 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 3700 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 3068 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 4648 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 4188 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 6108 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1912 wrote to memory of 3576 1912 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.exe 89 PID 3576 wrote to memory of 2128 3576 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 90 PID 2128 wrote to memory of 4312 2128 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 91 PID 4312 wrote to memory of 1808 4312 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 92 PID 1808 wrote to memory of 1680 1808 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 93 PID 1680 wrote to memory of 4292 1680 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 94 PID 4292 wrote to memory of 2924 4292 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 95 PID 2924 wrote to memory of 3668 2924 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 96 PID 3668 wrote to memory of 1352 3668 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 97 PID 1352 wrote to memory of 2312 1352 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 98 PID 2312 wrote to memory of 2324 2312 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 99 PID 2324 wrote to memory of 4104 2324 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 100 PID 4104 wrote to memory of 4788 4104 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 101 PID 4788 wrote to memory of 5260 4788 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 102 PID 5260 wrote to memory of 3960 5260 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 103 PID 3960 wrote to memory of 1264 3960 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 104 PID 1264 wrote to memory of 4324 1264 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 105 PID 4324 wrote to memory of 3428 4324 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 106 PID 3428 wrote to memory of 2264 3428 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 107 PID 2264 wrote to memory of 940 2264 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 108 PID 940 wrote to memory of 5772 940 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 109 PID 5772 wrote to memory of 5356 5772 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 110 PID 5356 wrote to memory of 244 5356 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 111 PID 244 wrote to memory of 240 244 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 112 PID 240 wrote to memory of 2488 240 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 113 PID 2488 wrote to memory of 4220 2488 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 114 PID 4220 wrote to memory of 5724 4220 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 115 PID 5724 wrote to memory of 6124 5724 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 116 PID 6124 wrote to memory of 4428 6124 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 117 PID 4428 wrote to memory of 2120 4428 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 118 PID 2120 wrote to memory of 2096 2120 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 119 PID 2096 wrote to memory of 5460 2096 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 120 PID 5460 wrote to memory of 4296 5460 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 121 PID 4296 wrote to memory of 1564 4296 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 122 PID 1564 wrote to memory of 704 1564 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 123 PID 704 wrote to memory of 2984 704 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 124 PID 2984 wrote to memory of 3396 2984 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 125 PID 3396 wrote to memory of 3404 3396 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 126 PID 3404 wrote to memory of 4452 3404 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 127 PID 4452 wrote to memory of 5196 4452 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 128 PID 5196 wrote to memory of 1932 5196 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 129 PID 1932 wrote to memory of 572 1932 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 130 PID 572 wrote to memory of 1532 572 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 131 PID 1532 wrote to memory of 5536 1532 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 132 PID 5536 wrote to memory of 5552 5536 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 133 PID 5552 wrote to memory of 3188 5552 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 134 PID 3188 wrote to memory of 5976 3188 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 135 PID 5976 wrote to memory of 5492 5976 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 136 PID 5492 wrote to memory of 2000 5492 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 137 PID 2000 wrote to memory of 944 2000 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 138 PID 944 wrote to memory of 2304 944 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 139 PID 2304 wrote to memory of 4268 2304 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 140 PID 4268 wrote to memory of 4072 4268 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 141 PID 4072 wrote to memory of 1228 4072 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 142 PID 1228 wrote to memory of 1788 1228 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 143 PID 1788 wrote to memory of 4308 1788 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 144 PID 4308 wrote to memory of 4364 4308 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 145 PID 4364 wrote to memory of 4992 4364 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 146 PID 4992 wrote to memory of 3452 4992 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 147 PID 3452 wrote to memory of 3700 3452 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 148 PID 3700 wrote to memory of 3068 3700 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 149 PID 3068 wrote to memory of 4648 3068 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 150 PID 4648 wrote to memory of 4188 4648 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 151 PID 4188 wrote to memory of 6108 4188 2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa66⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa67⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa68⤵
- System Location Discovery: System Language Discovery
PID:916 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa69⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa70⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa71⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa72⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa73⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa74⤵
- System Location Discovery: System Language Discovery
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa75⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa76⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa77⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa78⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa79⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa80⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa81⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa82⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa83⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa84⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa85⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa86⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa87⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa88⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa89⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa90⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa91⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa92⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa93⤵PID:5540
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa94⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa95⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa96⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa97⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa98⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa99⤵PID:5424
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa100⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa101⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa102⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa103⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa104⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa105⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa106⤵
- System Location Discovery: System Language Discovery
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa107⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa108⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa109⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa110⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa111⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa112⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa113⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa114⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa115⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa116⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa117⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa118⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa119⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa120⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa121⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-09-09_10feb306851c918abb21e065346604ef_akira_elex_rhadamanthys.usa122⤵PID:5292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-