Analysis
- max time kernel
71s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/04/2026, 14:09
Behavioral task
behavioral1
Sample
2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe
Resource
win10v2004-20260130-en
8 signatures
150 seconds
General
- Target 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe
- Size 10.9MB
- Sample260424-rf9e1acz2v
- SHA256 0d01914172c7b7f2a17e977d77844c3f6a39f35af7d3e6ee5b99566f4d65aed7
- MD5 cf39a82bbaefc085943e76c60fe5b210
- SHA1 2711c1f5cc3d6fc0f5c546b7764d746c19c32276
- SHA512 9efaf0233a0418881b11ca9363613859fe3d10661208c1ed063c4b17da1351228ff388053c073b6ded610e3fa6f2190c1373561ba0f6ed38c52702604c82ec0f
- SSDEEP 196608:Hl5XjvUeSJEul4sz4l5XjvUeSJEul4szm:HTzUeSqFa4TzUeSqFam
- TLSH T15CC67C217AC58638F5B741B0997CAF76802EFD340B7544CB67C06E266970AC36A36F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x002300000002b086-3.dat family_shodi behavioral2/files/0x001600000002b38a-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 1300 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 5052 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2880 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4772 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3488 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2836 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2984 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1396 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2904 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 836 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4384 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2012 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3944 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1644 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4916 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4244 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2136 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4652 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1100 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4940 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4260 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 688 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 440 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3696 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 320 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4400 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1680 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4228 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3892 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4724 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 336 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 5048 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4164 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3440 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 232 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 784 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4620 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4964 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3972 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1860 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1764 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1404 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2448 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1244 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3444 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2520 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 412 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3716 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1020 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1616 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2272 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 1868 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2280 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 824 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4592 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4060 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3096 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 984 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2024 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3416 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 3292 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 4528 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2036 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 2132 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaw.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSREC.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoev.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoasb.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoia.usa 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1176 wrote to memory of 1300 1176 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe 79 PID 1300 wrote to memory of 5052 1300 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 80 PID 5052 wrote to memory of 2880 5052 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 81 PID 2880 wrote to memory of 4772 2880 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 82 PID 4772 wrote to memory of 3488 4772 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 83 PID 3488 wrote to memory of 2836 3488 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 84 PID 2836 wrote to memory of 2984 2836 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 85 PID 2984 wrote to memory of 1396 2984 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 86 PID 1396 wrote to memory of 2904 1396 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 87 PID 2904 wrote to memory of 836 2904 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 88 PID 836 wrote to memory of 4384 836 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 89 PID 4384 wrote to memory of 2012 4384 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 90 PID 2012 wrote to memory of 3944 2012 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 91 PID 3944 wrote to memory of 1644 3944 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 92 PID 1644 wrote to memory of 4916 1644 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 93 PID 4916 wrote to memory of 4244 4916 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 94 PID 4244 wrote to memory of 2136 4244 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 95 PID 2136 wrote to memory of 4652 2136 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 96 PID 4652 wrote to memory of 1100 4652 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 97 PID 1100 wrote to memory of 4940 1100 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 98 PID 4940 wrote to memory of 4260 4940 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 99 PID 4260 wrote to memory of 688 4260 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 100 PID 688 wrote to memory of 440 688 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 101 PID 440 wrote to memory of 3696 440 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 102 PID 3696 wrote to memory of 320 3696 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 103 PID 320 wrote to memory of 4400 320 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 104 PID 4400 wrote to memory of 1680 4400 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 105 PID 1680 wrote to memory of 4228 1680 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 106 PID 4228 wrote to memory of 3892 4228 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 107 PID 3892 wrote to memory of 4724 3892 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 108 PID 4724 wrote to memory of 336 4724 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 109 PID 336 wrote to memory of 5048 336 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 110 PID 5048 wrote to memory of 4164 5048 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 111 PID 4164 wrote to memory of 3440 4164 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 112 PID 3440 wrote to memory of 232 3440 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 113 PID 232 wrote to memory of 784 232 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 114 PID 784 wrote to memory of 4620 784 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 115 PID 4620 wrote to memory of 4964 4620 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 116 PID 4964 wrote to memory of 3972 4964 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 117 PID 3972 wrote to memory of 1860 3972 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 118 PID 1860 wrote to memory of 1764 1860 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 119 PID 1764 wrote to memory of 1404 1764 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 120 PID 1404 wrote to memory of 2448 1404 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 121 PID 2448 wrote to memory of 1244 2448 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 122 PID 1244 wrote to memory of 3444 1244 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 123 PID 3444 wrote to memory of 2520 3444 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 124 PID 2520 wrote to memory of 412 2520 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 125 PID 412 wrote to memory of 3716 412 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 126 PID 3716 wrote to memory of 1020 3716 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 127 PID 1020 wrote to memory of 1616 1020 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 128 PID 1616 wrote to memory of 2272 1616 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 129 PID 2272 wrote to memory of 1868 2272 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 130 PID 1868 wrote to memory of 2280 1868 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 131 PID 2280 wrote to memory of 824 2280 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 132 PID 824 wrote to memory of 4592 824 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 133 PID 4592 wrote to memory of 4060 4592 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 134 PID 4060 wrote to memory of 3096 4060 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 135 PID 3096 wrote to memory of 984 3096 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 136 PID 984 wrote to memory of 2024 984 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 137 PID 2024 wrote to memory of 3416 2024 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 138 PID 3416 wrote to memory of 3292 3416 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 139 PID 3292 wrote to memory of 4528 3292 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 140 PID 4528 wrote to memory of 2036 4528 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 141 PID 2036 wrote to memory of 2132 2036 2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa66⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa67⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa68⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa69⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa70⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa71⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa72⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa73⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa74⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa75⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa76⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa77⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa78⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa79⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa80⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa81⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa82⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa83⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa84⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa85⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa86⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa87⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa88⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa89⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa90⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa91⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa92⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa93⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa94⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa95⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa96⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa97⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa98⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa99⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa100⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa101⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa102⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa103⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa104⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa105⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa106⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa107⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa108⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa109⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa110⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa111⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa112⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa113⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa114⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa115⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa116⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa117⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa118⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa119⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa120⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa121⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-04-24_cf39a82bbaefc085943e76c60fe5b210_akira_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa122⤵PID:5216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-