Analysis
- max time kernel
31s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 03:58
Behavioral task
behavioral1
Sample
2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe
- Size 8.2MB
- Sample260721-ejrm5sfw91
- SHA256 69fa4f6eab44932c89bc4d5e64b365abbbceba29ae4dca21b4a378259f2034a1
- MD5 9c3c2aba1e1c7d2c326b87f1f32352c4
- SHA1 7f420f7de8fa66f51b623f2382f4a68f5558a23e
- SHA512 b8a9fe0fdc8b186f2fb6c5ede2ab48b0d847a51215e9570a76c6279864ee07ed7afca7de3bc5730b69a61ebc97b3d4512ada44e94bb36a04e2bab003d510c8e3
- SSDEEP 196608:OEG45VPbRUZ/K0t6rXtEG45VPbRUZ/K0t6rXb:OEfVPbaZ/K0t6r9EfVPbaZ/K0t6rr
- TLSH T11A967D2277848F75D06F81B09A699AB6D137BC240F6657CF53807F1A3A31AD26B35B03
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x0008000000019cc1-3.dat family_shodi behavioral2/files/0x000d00000001c536-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 4708 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5788 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3332 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4356 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 572 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4100 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3456 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4636 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2064 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5860 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1120 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1504 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2908 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2488 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5196 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3012 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1252 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 6060 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3848 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2268 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1148 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4336 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1016 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 600 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3304 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3348 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3380 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2800 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5856 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5588 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 52 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 360 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 244 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1180 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3696 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2276 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4132 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3936 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4652 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4800 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1716 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1428 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5696 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5556 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 6128 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1928 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5628 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2956 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4292 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3192 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3580 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4880 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3916 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3904 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4596 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3384 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1056 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4340 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3336 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3584 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5016 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5936 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5848 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4284 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2692 wrote to memory of 4708 2692 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe 89 PID 4708 wrote to memory of 5788 4708 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 90 PID 5788 wrote to memory of 3332 5788 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 91 PID 3332 wrote to memory of 4356 3332 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 92 PID 4356 wrote to memory of 572 4356 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 93 PID 572 wrote to memory of 4100 572 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 94 PID 4100 wrote to memory of 3456 4100 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 95 PID 3456 wrote to memory of 4636 3456 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 96 PID 4636 wrote to memory of 2064 4636 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 97 PID 2064 wrote to memory of 5860 2064 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 98 PID 5860 wrote to memory of 1120 5860 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 99 PID 1120 wrote to memory of 1504 1120 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 100 PID 1504 wrote to memory of 2908 1504 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 101 PID 2908 wrote to memory of 2488 2908 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 102 PID 2488 wrote to memory of 5196 2488 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 103 PID 5196 wrote to memory of 3012 5196 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 104 PID 3012 wrote to memory of 1252 3012 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 105 PID 1252 wrote to memory of 6060 1252 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 106 PID 6060 wrote to memory of 3848 6060 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 107 PID 3848 wrote to memory of 2268 3848 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 108 PID 2268 wrote to memory of 1148 2268 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 109 PID 1148 wrote to memory of 4336 1148 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 110 PID 4336 wrote to memory of 1016 4336 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 111 PID 1016 wrote to memory of 600 1016 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 112 PID 600 wrote to memory of 3304 600 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 113 PID 3304 wrote to memory of 3348 3304 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 114 PID 3348 wrote to memory of 3380 3348 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 115 PID 3380 wrote to memory of 2800 3380 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 116 PID 2800 wrote to memory of 5856 2800 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 117 PID 5856 wrote to memory of 5588 5856 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 118 PID 5588 wrote to memory of 52 5588 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 119 PID 52 wrote to memory of 360 52 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 120 PID 360 wrote to memory of 244 360 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 121 PID 244 wrote to memory of 1180 244 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 122 PID 1180 wrote to memory of 3696 1180 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 123 PID 3696 wrote to memory of 2276 3696 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 124 PID 2276 wrote to memory of 4132 2276 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 125 PID 4132 wrote to memory of 3936 4132 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 126 PID 3936 wrote to memory of 4652 3936 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 127 PID 4652 wrote to memory of 4800 4652 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 128 PID 4800 wrote to memory of 1716 4800 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 129 PID 1716 wrote to memory of 1428 1716 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 130 PID 1428 wrote to memory of 5696 1428 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 131 PID 5696 wrote to memory of 5556 5696 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 132 PID 5556 wrote to memory of 6128 5556 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 133 PID 6128 wrote to memory of 1928 6128 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 134 PID 1928 wrote to memory of 5628 1928 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 135 PID 5628 wrote to memory of 2956 5628 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 136 PID 2956 wrote to memory of 4292 2956 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 137 PID 4292 wrote to memory of 3192 4292 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 138 PID 3192 wrote to memory of 3580 3192 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 139 PID 3580 wrote to memory of 4880 3580 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 140 PID 4880 wrote to memory of 3916 4880 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 141 PID 3916 wrote to memory of 3904 3916 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 142 PID 3904 wrote to memory of 4596 3904 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 143 PID 4596 wrote to memory of 3384 4596 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 144 PID 3384 wrote to memory of 1056 3384 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 145 PID 1056 wrote to memory of 4340 1056 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 146 PID 4340 wrote to memory of 3336 4340 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 147 PID 3336 wrote to memory of 3584 3336 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 148 PID 3584 wrote to memory of 5016 3584 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 149 PID 5016 wrote to memory of 5936 5016 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 150 PID 5936 wrote to memory of 5848 5936 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 151 PID 5848 wrote to memory of 4284 5848 2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa65⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa66⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa67⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa68⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa69⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa70⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa71⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa72⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa73⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa74⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa75⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa76⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa77⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa78⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa79⤵
- System Location Discovery: System Language Discovery
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa80⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa81⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa82⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa83⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa84⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa85⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa86⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa87⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa88⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa89⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa90⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa91⤵
- System Location Discovery: System Language Discovery
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa92⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa93⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa94⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa95⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa96⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa97⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa98⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa99⤵
- System Location Discovery: System Language Discovery
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa100⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa101⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa102⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa103⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa104⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa105⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa106⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa107⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa108⤵
- System Location Discovery: System Language Discovery
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa109⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa110⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa111⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa112⤵
- System Location Discovery: System Language Discovery
PID:720 -
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa113⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa114⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa115⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa116⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa117⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa118⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa119⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa120⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa121⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-21_9c3c2aba1e1c7d2c326b87f1f32352c4_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa122⤵PID:3808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-