Analysis
- max time kernel
29s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 03:50
Behavioral task
behavioral1
Sample
2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.exe
- Size 6.5MB
- Sample260707-edy52ahs7w
- SHA256 5549465233702053a4ae124f49e1bbe3a7548a202e8ee5203c89ee5761c1ed62
- MD5 527f73fb7de60d0bf0864926fe26a1ee
- SHA1 aa96bfc5b078fd5bfd620f04d79786caa18c34b6
- SHA512 5bddb3702dc3c6d00600e8d90468fd48f2e59e41e581c2ca5d85b2f7eac7875ec6472e787c3c931eaa2c060697041d07f96df2e9c840825db0c4c53ad06f96e1
- SSDEEP 98304:OP30oAaldmdi2UgXq9ouFkHP30oAaldmdi2UgXq9ouFko:GkKmdi2S9+vkKmdi2S9+o
- TLSH T138669C13B6E500B8E41AD179974AAA36E976F8090735B9EF07819A213F73FD1273E701
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000600000001b7ea-3.dat family_shodi behavioral2/files/0x000d00000001c53c-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 5512 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 4792 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 6100 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 5060 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 2864 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 1668 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 5644 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 3056 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 3328 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 3276 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 4456 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 4520 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 2140 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 2824 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 1968 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 5528 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 4776 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 4260 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 3956 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 2880 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 984 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 472 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 5148 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 1952 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 1948 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 4068 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 2364 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 1224 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 2704 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 5016 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 480 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 1828 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 5428 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 788 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 2128 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 1540 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 4092 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 1440 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 1692 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 3492 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 3476 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 5020 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 1356 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 2512 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 4952 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 684 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 1516 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 296 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 256 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 5172 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 5800 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 1532 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 3252 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 4980 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 556 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 2524 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 6024 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 3320 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 2056 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 1788 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 1992 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 1112 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 1276 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 5956 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4816 wrote to memory of 5512 4816 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.exe 87 PID 5512 wrote to memory of 4792 5512 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 88 PID 4792 wrote to memory of 6100 4792 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 89 PID 6100 wrote to memory of 5060 6100 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 90 PID 5060 wrote to memory of 2864 5060 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 91 PID 2864 wrote to memory of 1668 2864 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 92 PID 1668 wrote to memory of 5644 1668 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 93 PID 5644 wrote to memory of 3056 5644 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 94 PID 3056 wrote to memory of 3328 3056 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 95 PID 3328 wrote to memory of 3276 3328 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 96 PID 3276 wrote to memory of 4456 3276 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 97 PID 4456 wrote to memory of 4520 4456 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 98 PID 4520 wrote to memory of 2140 4520 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 99 PID 2140 wrote to memory of 2824 2140 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 100 PID 2824 wrote to memory of 1968 2824 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 101 PID 1968 wrote to memory of 5528 1968 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 102 PID 5528 wrote to memory of 4776 5528 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 103 PID 4776 wrote to memory of 4260 4776 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 104 PID 4260 wrote to memory of 3956 4260 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 105 PID 3956 wrote to memory of 2880 3956 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 106 PID 2880 wrote to memory of 984 2880 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 107 PID 984 wrote to memory of 472 984 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 108 PID 472 wrote to memory of 5148 472 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 109 PID 5148 wrote to memory of 1952 5148 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 110 PID 1952 wrote to memory of 1948 1952 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 111 PID 1948 wrote to memory of 4068 1948 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 112 PID 4068 wrote to memory of 2364 4068 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 113 PID 2364 wrote to memory of 1224 2364 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 114 PID 1224 wrote to memory of 2704 1224 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 115 PID 2704 wrote to memory of 5016 2704 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 116 PID 5016 wrote to memory of 480 5016 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 117 PID 480 wrote to memory of 1828 480 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 118 PID 1828 wrote to memory of 5428 1828 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 119 PID 5428 wrote to memory of 788 5428 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 120 PID 788 wrote to memory of 2128 788 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 121 PID 2128 wrote to memory of 1540 2128 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 122 PID 1540 wrote to memory of 4092 1540 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 123 PID 4092 wrote to memory of 1440 4092 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 124 PID 1440 wrote to memory of 1692 1440 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 125 PID 1692 wrote to memory of 3492 1692 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 126 PID 3492 wrote to memory of 3476 3492 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 127 PID 3476 wrote to memory of 5020 3476 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 128 PID 5020 wrote to memory of 1356 5020 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 129 PID 1356 wrote to memory of 2512 1356 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 130 PID 2512 wrote to memory of 4952 2512 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 131 PID 4952 wrote to memory of 684 4952 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 132 PID 684 wrote to memory of 1516 684 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 133 PID 1516 wrote to memory of 296 1516 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 134 PID 296 wrote to memory of 256 296 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 135 PID 256 wrote to memory of 5172 256 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 136 PID 5172 wrote to memory of 5800 5172 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 137 PID 5800 wrote to memory of 1532 5800 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 138 PID 1532 wrote to memory of 3252 1532 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 139 PID 3252 wrote to memory of 4980 3252 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 140 PID 4980 wrote to memory of 556 4980 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 141 PID 556 wrote to memory of 2524 556 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 142 PID 2524 wrote to memory of 6024 2524 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 143 PID 6024 wrote to memory of 3320 6024 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 144 PID 3320 wrote to memory of 2056 3320 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 145 PID 2056 wrote to memory of 1788 2056 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 146 PID 1788 wrote to memory of 1992 1788 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 147 PID 1992 wrote to memory of 1112 1992 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 148 PID 1112 wrote to memory of 1276 1112 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 149 PID 1276 wrote to memory of 5956 1276 2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa65⤵
- Executes dropped EXE
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa66⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa67⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa68⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa69⤵PID:5424
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa70⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa71⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa72⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa73⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa74⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa75⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa76⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa77⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa78⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa79⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa80⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa81⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa82⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa83⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa84⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa85⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa86⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa87⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa88⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa89⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa90⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa91⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa92⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa93⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa94⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa95⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa96⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa97⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa98⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa99⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa100⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa101⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa102⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa103⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa104⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa105⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa106⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa107⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa108⤵
- System Location Discovery: System Language Discovery
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa109⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa110⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa111⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa112⤵
- System Location Discovery: System Language Discovery
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa113⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa114⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa115⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa116⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa117⤵PID:5828
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa118⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa119⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa120⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa121⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_527f73fb7de60d0bf0864926fe26a1ee_akira_cloudeye_cobalt-strike_elex_rhadamanthys_vidar.usa122⤵PID:4152
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-