Analysis
- max time kernel
34s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/07/2026, 03:58
Behavioral task
behavioral1
Sample
2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe
- Size 8.2MB
- Sample260721-ejrm5sfw91
- SHA256 69fa4f6eab44932c89bc4d5e64b365abbbceba29ae4dca21b4a378259f2034a1
- MD5 9c3c2aba1e1c7d2c326b87f1f32352c4
- SHA1 7f420f7de8fa66f51b623f2382f4a68f5558a23e
- SHA512 b8a9fe0fdc8b186f2fb6c5ede2ab48b0d847a51215e9570a76c6279864ee07ed7afca7de3bc5730b69a61ebc97b3d4512ada44e94bb36a04e2bab003d510c8e3
- SSDEEP 196608:OEG45VPbRUZ/K0t6rXtEG45VPbRUZ/K0t6rXb:OEfVPbaZ/K0t6r9EfVPbaZ/K0t6rr
- TLSH T11A967D2277848F75D06F81B09A699AB6D137BC240F6657CF53807F1A3A31AD26B35B03
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral1/files/0x0007000000023216-3.dat family_shodi behavioral1/files/0x00080000000245fc-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 3896 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2708 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4536 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2284 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4356 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1548 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4888 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4336 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4732 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2968 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3876 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4404 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3780 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4200 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3748 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3628 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1428 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2516 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1692 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 496 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5052 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4260 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2196 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4524 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4556 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2200 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4632 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1616 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2420 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3692 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1944 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2936 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 376 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3788 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2452 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2820 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3944 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3052 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2924 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1640 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3160 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3300 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4980 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3204 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2348 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2484 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3768 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1324 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4620 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2464 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3716 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2632 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3776 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1984 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4240 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3232 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2208 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4188 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4884 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2116 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4844 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2412 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4464 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3808 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe - Drops file in Program Files directory 7 IoCs
description ioc Process File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.usa 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3828 wrote to memory of 3896 3828 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe 86 PID 3896 wrote to memory of 2708 3896 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 87 PID 2708 wrote to memory of 4536 2708 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 88 PID 4536 wrote to memory of 2284 4536 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 89 PID 2284 wrote to memory of 4356 2284 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 90 PID 4356 wrote to memory of 1548 4356 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 91 PID 1548 wrote to memory of 4888 1548 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 92 PID 4888 wrote to memory of 4336 4888 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 93 PID 4336 wrote to memory of 4732 4336 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 94 PID 4732 wrote to memory of 2968 4732 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 95 PID 2968 wrote to memory of 3876 2968 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 96 PID 3876 wrote to memory of 4404 3876 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 97 PID 4404 wrote to memory of 3780 4404 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 98 PID 3780 wrote to memory of 4200 3780 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 99 PID 4200 wrote to memory of 3748 4200 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 100 PID 3748 wrote to memory of 3628 3748 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 101 PID 3628 wrote to memory of 1428 3628 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 102 PID 1428 wrote to memory of 2516 1428 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 103 PID 2516 wrote to memory of 1692 2516 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 104 PID 1692 wrote to memory of 496 1692 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 105 PID 496 wrote to memory of 5052 496 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 106 PID 5052 wrote to memory of 4260 5052 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 107 PID 4260 wrote to memory of 2196 4260 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 108 PID 2196 wrote to memory of 4524 2196 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 109 PID 4524 wrote to memory of 4556 4524 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 110 PID 4556 wrote to memory of 2200 4556 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 111 PID 2200 wrote to memory of 4632 2200 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 112 PID 4632 wrote to memory of 1616 4632 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 113 PID 1616 wrote to memory of 2420 1616 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 114 PID 2420 wrote to memory of 3692 2420 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 115 PID 3692 wrote to memory of 1944 3692 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 116 PID 1944 wrote to memory of 2936 1944 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 117 PID 2936 wrote to memory of 376 2936 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 118 PID 376 wrote to memory of 3788 376 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 119 PID 3788 wrote to memory of 2452 3788 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 120 PID 2452 wrote to memory of 2820 2452 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 121 PID 2820 wrote to memory of 3944 2820 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 122 PID 3944 wrote to memory of 3052 3944 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 123 PID 3052 wrote to memory of 2924 3052 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 124 PID 2924 wrote to memory of 1640 2924 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 125 PID 1640 wrote to memory of 3160 1640 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 126 PID 3160 wrote to memory of 3300 3160 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 127 PID 3300 wrote to memory of 4980 3300 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 128 PID 4980 wrote to memory of 3204 4980 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 129 PID 3204 wrote to memory of 2348 3204 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 130 PID 2348 wrote to memory of 2484 2348 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 131 PID 2484 wrote to memory of 3768 2484 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 132 PID 3768 wrote to memory of 1324 3768 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 133 PID 1324 wrote to memory of 4620 1324 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 134 PID 4620 wrote to memory of 2464 4620 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 135 PID 2464 wrote to memory of 3716 2464 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 136 PID 3716 wrote to memory of 2632 3716 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 137 PID 2632 wrote to memory of 3776 2632 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 138 PID 3776 wrote to memory of 1984 3776 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 139 PID 1984 wrote to memory of 4240 1984 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 140 PID 4240 wrote to memory of 3232 4240 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 141 PID 3232 wrote to memory of 2208 3232 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 142 PID 2208 wrote to memory of 4188 2208 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 143 PID 4188 wrote to memory of 4884 4188 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 144 PID 4884 wrote to memory of 2116 4884 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 145 PID 2116 wrote to memory of 4844 2116 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 146 PID 4844 wrote to memory of 2412 4844 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 147 PID 2412 wrote to memory of 4464 2412 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 148 PID 4464 wrote to memory of 3808 4464 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa65⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa66⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa67⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa68⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa69⤵
- System Location Discovery: System Language Discovery
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa70⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa71⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa72⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa73⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa74⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa75⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa76⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa77⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa78⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa79⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa80⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa81⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa82⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa83⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa84⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa85⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa86⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa87⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa88⤵
- System Location Discovery: System Language Discovery
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa89⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa90⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa91⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa92⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa93⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa94⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa95⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa96⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa97⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa98⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa99⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa100⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa101⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa102⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa103⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa104⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa105⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa106⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa107⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa108⤵PID:5192
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa109⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa110⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa111⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa112⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa113⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa114⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa115⤵
- System Location Discovery: System Language Discovery
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa116⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa117⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa118⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa119⤵PID:5376
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa120⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa121⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa122⤵PID:5424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-