Analysis
- max time kernel
39s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 14:45
Behavioral task
behavioral1
Sample
2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe
- Size 10.5MB
- Sample260730-r41srstxdx
- SHA256 640b575faec4f3699bf51578c538c2420500f65130f43dc9cbc4f4480d16f093
- MD5 ed1a5ad7fe2cf0bff884a352077fe3e3
- SHA1 ed58b9ec58167c46e669fe5bad2eb65ba56096ef
- SHA512 5ef0e4b206de518d9baa32e401e79ded39d67da31150341946c04aed70d710c27ae8e9b0c7fb396cccb944d9872f24d50adbef0ccaf340ba136fb786cce23e58
- SSDEEP 196608:qEG45VPbRUZ/K0t6rXH/h4tqEG45VPbRUZ/K0t6rXH/h4th:qEfVPbaZ/K0t6rPhgqEfVPbaZ/K0t6rm
- TLSH T166B68E227684CF64E06F81B099B959B69037BC250F7557CBA7803F1A3A31AD26F35B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 2 IoCs
resource yara_rule behavioral2/files/0x000b00000001b315-3.dat family_shodi behavioral2/files/0x000d00000001c5d4-68.dat family_shodi - Executes dropped EXE 64 IoCs
pid Process 5716 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4984 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1300 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2848 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2364 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2516 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3552 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1684 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2576 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5660 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3084 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5340 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2588 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5204 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4260 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1288 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2384 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 208 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 260 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1908 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4484 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2492 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 6080 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4284 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5072 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 6088 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5416 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3504 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4568 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2472 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3332 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5252 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 6132 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 828 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4820 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4544 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4324 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 6108 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4632 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3560 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4356 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3972 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2884 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4780 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3764 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4692 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4308 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4248 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5044 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3876 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4724 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4696 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2100 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 4864 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5640 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 3140 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5512 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5584 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2028 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2056 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 2932 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 5216 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 772 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 1868 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe - Drops file in Program Files directory 9 IoCs
description ioc Process File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File created \??\c:\Program Files\7-Zip\7zFM.exe 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File created \??\c:\Program Files\7-Zip\Uninstall.exe 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.usa 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.usa 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3184 wrote to memory of 5716 3184 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe 89 PID 5716 wrote to memory of 4984 5716 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 90 PID 4984 wrote to memory of 1300 4984 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 91 PID 1300 wrote to memory of 2848 1300 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 92 PID 2848 wrote to memory of 2364 2848 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 93 PID 2364 wrote to memory of 2516 2364 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 94 PID 2516 wrote to memory of 3552 2516 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 95 PID 3552 wrote to memory of 1684 3552 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 96 PID 1684 wrote to memory of 2576 1684 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 97 PID 2576 wrote to memory of 5660 2576 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 98 PID 5660 wrote to memory of 3084 5660 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 99 PID 3084 wrote to memory of 5340 3084 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 100 PID 5340 wrote to memory of 2588 5340 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 101 PID 2588 wrote to memory of 5204 2588 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 102 PID 5204 wrote to memory of 4260 5204 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 103 PID 4260 wrote to memory of 1288 4260 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 104 PID 1288 wrote to memory of 2384 1288 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 105 PID 2384 wrote to memory of 208 2384 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 106 PID 208 wrote to memory of 260 208 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 107 PID 260 wrote to memory of 1908 260 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 108 PID 1908 wrote to memory of 4484 1908 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 109 PID 4484 wrote to memory of 2492 4484 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 110 PID 2492 wrote to memory of 6080 2492 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 111 PID 6080 wrote to memory of 4284 6080 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 112 PID 4284 wrote to memory of 5072 4284 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 113 PID 5072 wrote to memory of 6088 5072 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 114 PID 6088 wrote to memory of 5416 6088 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 115 PID 5416 wrote to memory of 3504 5416 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 116 PID 3504 wrote to memory of 4568 3504 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 117 PID 4568 wrote to memory of 2472 4568 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 118 PID 2472 wrote to memory of 3332 2472 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 119 PID 3332 wrote to memory of 5252 3332 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 120 PID 5252 wrote to memory of 6132 5252 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 121 PID 6132 wrote to memory of 828 6132 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 122 PID 828 wrote to memory of 4820 828 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 123 PID 4820 wrote to memory of 4544 4820 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 124 PID 4544 wrote to memory of 4324 4544 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 125 PID 4324 wrote to memory of 6108 4324 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 126 PID 6108 wrote to memory of 4632 6108 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 127 PID 4632 wrote to memory of 3560 4632 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 128 PID 3560 wrote to memory of 4356 3560 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 129 PID 4356 wrote to memory of 3972 4356 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 130 PID 3972 wrote to memory of 2884 3972 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 131 PID 2884 wrote to memory of 4780 2884 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 132 PID 4780 wrote to memory of 3764 4780 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 133 PID 3764 wrote to memory of 4692 3764 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 134 PID 4692 wrote to memory of 4308 4692 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 135 PID 4308 wrote to memory of 4248 4308 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 136 PID 4248 wrote to memory of 5044 4248 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 137 PID 5044 wrote to memory of 3876 5044 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 138 PID 3876 wrote to memory of 4724 3876 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 139 PID 4724 wrote to memory of 4696 4724 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 140 PID 4696 wrote to memory of 2100 4696 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 141 PID 2100 wrote to memory of 4864 2100 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 142 PID 4864 wrote to memory of 5640 4864 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 143 PID 5640 wrote to memory of 3140 5640 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 144 PID 3140 wrote to memory of 5512 3140 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 145 PID 5512 wrote to memory of 5584 5512 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 146 PID 5584 wrote to memory of 2028 5584 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 147 PID 2028 wrote to memory of 2056 2028 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 148 PID 2056 wrote to memory of 2932 2056 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 149 PID 2932 wrote to memory of 5216 2932 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 150 PID 5216 wrote to memory of 772 5216 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 151 PID 772 wrote to memory of 1868 772 2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa65⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa66⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa67⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa68⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa69⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa70⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa71⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa72⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa73⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa74⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa75⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa76⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa77⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa78⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa79⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa80⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa81⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa82⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa83⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa84⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa85⤵PID:5488
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa86⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa87⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa88⤵
- System Location Discovery: System Language Discovery
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa89⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa90⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa91⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa92⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa93⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa94⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa95⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa96⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa97⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa98⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa99⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa100⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa101⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa102⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa103⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa104⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa105⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa106⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa107⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa108⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa109⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa110⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa111⤵
- System Location Discovery: System Language Discovery
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa112⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa113⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa114⤵
- System Location Discovery: System Language Discovery
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa115⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa116⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa117⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa118⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa119⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa120⤵
- System Location Discovery: System Language Discovery
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa121⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usaC:\Users\Admin\AppData\Local\Temp\2026-07-30_ed1a5ad7fe2cf0bff884a352077fe3e3_akira_amadey_cloudeye_cobalt-strike_elex_hijackloader_lu.usa122⤵PID:3848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-