Analysis
- max time kernel
38s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 13:28
Behavioral task
behavioral1
Sample
2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe
- Size 8.2MB
- Sample260702-qq4f3afs31
- SHA256 097bff64a907bfea3e63dc07f6b3a36a079dddd832c1be6cecbf163fb926ed42
- MD5 2f339b77b134896ff5569ca92fad6b1a
- SHA1 5e7193b929bbe2dcda8ab618baa7d9930c134078
- SHA512 1ca4a644d372352dee84017426921db2a93e31d025a69a74a8cc81204b08ab6e9b24789e3392b88d634ecd7184a9008624854f59516114e6794318d52031138c
- SSDEEP 196608:GEG45VPbRUZ/K0t6rXUEG45VPbRUZ/K0t6rXb:GEfVPbaZ/K0t6rkEfVPbaZ/K0t6rr
- TLSH T1F2967D2277848F75D06F81B09A699AB6D137BC240F6657CF53807F1A3A31AD26B35B03
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000600000001b850-3.dat family_shodi behavioral2/files/0x001000000001c5a0-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 1748 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3388 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3196 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2568 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1364 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1512 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4572 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2480 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2404 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4292 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4188 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5828 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3804 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4752 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5884 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4308 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4884 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4404 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 940 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 912 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4568 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2776 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 572 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4840 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5188 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3276 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1964 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4712 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1388 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2344 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3312 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3932 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2420 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4896 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5252 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5860 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2688 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5784 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2200 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2228 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1140 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4288 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5756 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5804 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3268 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4092 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4268 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5992 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2580 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4228 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 6108 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3060 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3672 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4372 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1392 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1904 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 988 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 52 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 240 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2860 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 6124 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4524 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5356 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2096 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe - Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.usa 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.usa 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2512 wrote to memory of 1748 2512 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe 88 PID 1748 wrote to memory of 3388 1748 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 89 PID 3388 wrote to memory of 3196 3388 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 90 PID 3196 wrote to memory of 2568 3196 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 91 PID 2568 wrote to memory of 1364 2568 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 92 PID 1364 wrote to memory of 1512 1364 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 93 PID 1512 wrote to memory of 4572 1512 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 94 PID 4572 wrote to memory of 2480 4572 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 95 PID 2480 wrote to memory of 2404 2480 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 96 PID 2404 wrote to memory of 4292 2404 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 97 PID 4292 wrote to memory of 4188 4292 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 98 PID 4188 wrote to memory of 5828 4188 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 99 PID 5828 wrote to memory of 3804 5828 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 100 PID 3804 wrote to memory of 4752 3804 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 101 PID 4752 wrote to memory of 5884 4752 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 102 PID 5884 wrote to memory of 4308 5884 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 103 PID 4308 wrote to memory of 4884 4308 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 104 PID 4884 wrote to memory of 4404 4884 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 105 PID 4404 wrote to memory of 940 4404 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 106 PID 940 wrote to memory of 912 940 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 107 PID 912 wrote to memory of 4568 912 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 108 PID 4568 wrote to memory of 2776 4568 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 109 PID 2776 wrote to memory of 572 2776 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 110 PID 572 wrote to memory of 4840 572 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 111 PID 4840 wrote to memory of 5188 4840 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 112 PID 5188 wrote to memory of 3276 5188 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 113 PID 3276 wrote to memory of 1964 3276 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 114 PID 1964 wrote to memory of 4712 1964 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 115 PID 4712 wrote to memory of 1388 4712 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 116 PID 1388 wrote to memory of 2344 1388 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 117 PID 2344 wrote to memory of 3312 2344 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 118 PID 3312 wrote to memory of 3932 3312 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 119 PID 3932 wrote to memory of 2420 3932 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 120 PID 2420 wrote to memory of 4896 2420 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 121 PID 4896 wrote to memory of 5252 4896 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 122 PID 5252 wrote to memory of 5860 5252 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 123 PID 5860 wrote to memory of 2688 5860 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 124 PID 2688 wrote to memory of 5784 2688 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 125 PID 5784 wrote to memory of 2200 5784 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 126 PID 2200 wrote to memory of 2228 2200 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 127 PID 2228 wrote to memory of 1140 2228 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 128 PID 1140 wrote to memory of 4288 1140 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 129 PID 4288 wrote to memory of 5756 4288 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 130 PID 5756 wrote to memory of 5804 5756 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 131 PID 5804 wrote to memory of 3268 5804 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 132 PID 3268 wrote to memory of 4092 3268 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 133 PID 4092 wrote to memory of 4268 4092 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 134 PID 4268 wrote to memory of 5992 4268 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 135 PID 5992 wrote to memory of 2580 5992 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 136 PID 2580 wrote to memory of 4228 2580 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 137 PID 4228 wrote to memory of 6108 4228 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 138 PID 6108 wrote to memory of 3060 6108 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 139 PID 3060 wrote to memory of 3672 3060 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 140 PID 3672 wrote to memory of 4372 3672 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 141 PID 4372 wrote to memory of 1392 4372 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 142 PID 1392 wrote to memory of 1904 1392 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 143 PID 1904 wrote to memory of 988 1904 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 144 PID 988 wrote to memory of 52 988 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 145 PID 52 wrote to memory of 240 52 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 146 PID 240 wrote to memory of 2860 240 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 147 PID 2860 wrote to memory of 6124 2860 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 148 PID 6124 wrote to memory of 4524 6124 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 149 PID 4524 wrote to memory of 5356 4524 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 150 PID 5356 wrote to memory of 2096 5356 2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa65⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa66⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa67⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa68⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa69⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa70⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa71⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa72⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa73⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa74⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa75⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa76⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa77⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa78⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa79⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa80⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa81⤵PID:6028
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa82⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa83⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa84⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa85⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa86⤵
- System Location Discovery: System Language Discovery
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa87⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa88⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa89⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa90⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa91⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa92⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa93⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa94⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa95⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa96⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa97⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa98⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa99⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa100⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa101⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa102⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa103⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa104⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa105⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa106⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa107⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa108⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa109⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa110⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa111⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa112⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa113⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa114⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa115⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa116⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa117⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa118⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa119⤵
- System Location Discovery: System Language Discovery
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa120⤵PID:6148
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa121⤵PID:6164
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-02_2f339b77b134896ff5569ca92fad6b1a_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa122⤵PID:6180
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-