Analysis
- max time kernel
42s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/10/2026, 14:37
Behavioral task
behavioral1
Sample
2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe
Resource
win10v2004-20260911-en
7 signatures
150 seconds
General
- Target 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe
- Size 5.3MB
- Sample261020-ry7dcs1vfs
- SHA256 d7ebb37ea10afa0bd60f3baffdd3f33df31e538e31937a1a9f6b964b6708925d
- MD5 8463fb0e0a2c9145b836fe996d11af03
- SHA1 d1dc52da1a0085eb029d0b2ef6ca7b8f855082e2
- SHA512 5b92267274d12ad5e540477bcb0ad79eb8f7e946290ee06b7c9eb8b5be7dc685e03be44318b2352990f12248b234150cd1e650f5f4b50fc4e766852faf933238
- SSDEEP 98304:EU25/h4tZNh7XExcawrU25/h4tZNh7XExcawC:x25/h4tFO25/h4tFU
- TLSH T1E246AE91754CC866E516907B66B438598038B4E7E3B118CBFFC03D30666AED3AD3A367
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral1/files/0x002b00000001b679-2.dat family_shodi behavioral1/files/0x000800000002435e-67.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 3896 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4872 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4404 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4328 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4424 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5088 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4264 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 972 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3516 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4820 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2136 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4188 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3780 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2168 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4556 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1848 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 5032 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4216 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2088 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4108 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3488 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4996 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1756 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2636 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 640 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 216 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2744 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2056 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2880 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3416 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2520 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4372 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1284 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4988 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3096 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2072 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2892 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4916 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4668 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2904 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1828 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1832 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4160 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2620 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1684 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 816 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2800 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2336 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 1160 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2576 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3708 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 464 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4716 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2884 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2000 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3696 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 848 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3616 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4420 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2972 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 2012 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 4128 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3632 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 3512 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe - Drops file in Program Files directory 32 IoCs
description ioc Process File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.usa 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.usa 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.usa 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.usa 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.usa 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.usa 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.usa 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.usa 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.usa 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.usa 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.usa 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3012 wrote to memory of 3896 3012 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe 84 PID 3896 wrote to memory of 4872 3896 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 85 PID 4872 wrote to memory of 4404 4872 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 86 PID 4404 wrote to memory of 4328 4404 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 87 PID 4328 wrote to memory of 4424 4328 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 88 PID 4424 wrote to memory of 5088 4424 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 89 PID 5088 wrote to memory of 4264 5088 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 90 PID 4264 wrote to memory of 972 4264 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 91 PID 972 wrote to memory of 3516 972 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 92 PID 3516 wrote to memory of 4820 3516 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 93 PID 4820 wrote to memory of 2136 4820 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 94 PID 2136 wrote to memory of 4188 2136 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 95 PID 4188 wrote to memory of 3780 4188 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 96 PID 3780 wrote to memory of 2168 3780 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 97 PID 2168 wrote to memory of 4556 2168 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 98 PID 4556 wrote to memory of 1848 4556 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 99 PID 1848 wrote to memory of 5032 1848 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 100 PID 5032 wrote to memory of 4216 5032 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 101 PID 4216 wrote to memory of 2088 4216 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 102 PID 2088 wrote to memory of 4108 2088 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 103 PID 4108 wrote to memory of 3488 4108 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 104 PID 3488 wrote to memory of 4996 3488 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 105 PID 4996 wrote to memory of 1756 4996 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 106 PID 1756 wrote to memory of 2636 1756 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 107 PID 2636 wrote to memory of 640 2636 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 108 PID 640 wrote to memory of 216 640 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 109 PID 216 wrote to memory of 2744 216 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 110 PID 2744 wrote to memory of 2056 2744 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 111 PID 2056 wrote to memory of 2880 2056 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 112 PID 2880 wrote to memory of 3416 2880 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 113 PID 3416 wrote to memory of 2520 3416 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 114 PID 2520 wrote to memory of 4372 2520 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 115 PID 4372 wrote to memory of 1284 4372 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 116 PID 1284 wrote to memory of 4988 1284 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 117 PID 4988 wrote to memory of 3096 4988 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 118 PID 3096 wrote to memory of 2072 3096 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 119 PID 2072 wrote to memory of 2892 2072 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 120 PID 2892 wrote to memory of 4916 2892 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 121 PID 4916 wrote to memory of 4668 4916 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 122 PID 4668 wrote to memory of 2904 4668 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 123 PID 2904 wrote to memory of 1828 2904 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 124 PID 1828 wrote to memory of 1832 1828 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 125 PID 1832 wrote to memory of 4160 1832 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 126 PID 4160 wrote to memory of 2620 4160 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 127 PID 2620 wrote to memory of 1684 2620 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 128 PID 1684 wrote to memory of 816 1684 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 129 PID 816 wrote to memory of 2800 816 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 130 PID 2800 wrote to memory of 2336 2800 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 131 PID 2336 wrote to memory of 1160 2336 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 132 PID 1160 wrote to memory of 2576 1160 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 133 PID 2576 wrote to memory of 3708 2576 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 134 PID 3708 wrote to memory of 464 3708 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 135 PID 464 wrote to memory of 4716 464 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 136 PID 4716 wrote to memory of 2884 4716 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 137 PID 2884 wrote to memory of 2000 2884 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 138 PID 2000 wrote to memory of 3696 2000 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 139 PID 3696 wrote to memory of 848 3696 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 140 PID 848 wrote to memory of 3616 848 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 141 PID 3616 wrote to memory of 4420 3616 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 142 PID 4420 wrote to memory of 2972 4420 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 143 PID 2972 wrote to memory of 2012 2972 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 144 PID 2012 wrote to memory of 4128 2012 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 145 PID 4128 wrote to memory of 3632 4128 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 146 PID 3632 wrote to memory of 3512 3632 2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa65⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa66⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa67⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa68⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa69⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa70⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa71⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa72⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa73⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa74⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa75⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa76⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa77⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa78⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa79⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa80⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa81⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa82⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa83⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa84⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa85⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa86⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa87⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa88⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa89⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa90⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa91⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa92⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa93⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa94⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa95⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa96⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa97⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa98⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa99⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa100⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa101⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa102⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa103⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa104⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa105⤵PID:5236
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa106⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa107⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa108⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa109⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa110⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa111⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa112⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa113⤵PID:5364
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa114⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa115⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa116⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa117⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa118⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa119⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa120⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa121⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-10-19_8463fb0e0a2c9145b836fe996d11af03_akira_elex_luca-stealer_njrat_remcos_rhadamanthys.usa122⤵PID:5508
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-