Analysis
- max time kernel
29s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 16:32
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
- Size 429KB
- Sample260930-t15cwsda67
- SHA256 c46d1e6c3805050040bdaae9618e886bdc3acb10fc6aba618214f4a372a044e8
- MD5 ccf0f1ec3ca041c9aca690548eab214a
- SHA1 316ca707924a398a8d690663937345de0b6a2fbe
- SHA512 822398cdef2d92eec28707a33e1fda83a394364105b80e1571165b664d4ff8b55a4d8efcfc70de2a0b1e6a37327afd1384a4b34ca25acc5134c3b199480c75d2
- SSDEEP 6144:Lr3b4DwVdEXQCPD7fr1MRHLlCvlp55TBwvrXhHKSBx/M2L8PPrju4t:T48nEXXD9M8KTgK/M2LUPrV
- TLSH T1B294BF16FA9814F8E5ABC03CC2568A53A977B8420721DAEF036492343F67BE45F3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe Key value queried \REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1056 wrote to memory of 728 1056 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 86 PID 728 wrote to memory of 4676 728 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 87 PID 4676 wrote to memory of 812 4676 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 88 PID 812 wrote to memory of 1068 812 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 89 PID 1068 wrote to memory of 3840 1068 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 90 PID 3840 wrote to memory of 1680 3840 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 92 PID 1680 wrote to memory of 4832 1680 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 93 PID 4832 wrote to memory of 1776 4832 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 94 PID 1776 wrote to memory of 4796 1776 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 95 PID 4796 wrote to memory of 2452 4796 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 97 PID 2452 wrote to memory of 1020 2452 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 98 PID 1020 wrote to memory of 3652 1020 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 99 PID 3652 wrote to memory of 3164 3652 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 100 PID 3164 wrote to memory of 320 3164 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 101 PID 320 wrote to memory of 548 320 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 103 PID 548 wrote to memory of 1312 548 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 104 PID 1312 wrote to memory of 864 1312 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 105 PID 864 wrote to memory of 2964 864 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 106 PID 2964 wrote to memory of 3588 2964 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 107 PID 3588 wrote to memory of 3356 3588 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 109 PID 3356 wrote to memory of 64 3356 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 110 PID 64 wrote to memory of 4232 64 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 111 PID 4232 wrote to memory of 948 4232 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 112 PID 948 wrote to memory of 2732 948 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 113 PID 2732 wrote to memory of 1820 2732 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 114 PID 1820 wrote to memory of 1004 1820 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 115 PID 1004 wrote to memory of 868 1004 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 116 PID 868 wrote to memory of 2692 868 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 117 PID 2692 wrote to memory of 2428 2692 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 118 PID 2428 wrote to memory of 3256 2428 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 121 PID 3256 wrote to memory of 1296 3256 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 122 PID 1296 wrote to memory of 4764 1296 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 123 PID 4764 wrote to memory of 536 4764 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 124 PID 536 wrote to memory of 748 536 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 125 PID 748 wrote to memory of 3044 748 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 126 PID 3044 wrote to memory of 4480 3044 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 127 PID 4480 wrote to memory of 5016 4480 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 128 PID 5016 wrote to memory of 4744 5016 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 129 PID 4744 wrote to memory of 2920 4744 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 130 PID 2920 wrote to memory of 3900 2920 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 131 PID 3900 wrote to memory of 2336 3900 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 132 PID 2336 wrote to memory of 3188 2336 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 133 PID 3188 wrote to memory of 1548 3188 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 135 PID 1548 wrote to memory of 4556 1548 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 137 PID 4556 wrote to memory of 432 4556 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 138 PID 432 wrote to memory of 5044 432 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 139 PID 5044 wrote to memory of 4988 5044 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 140 PID 4988 wrote to memory of 2676 4988 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 141 PID 2676 wrote to memory of 4424 2676 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 142 PID 4424 wrote to memory of 4696 4424 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 143 PID 4696 wrote to memory of 4428 4696 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 144 PID 4428 wrote to memory of 4836 4428 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 145 PID 4836 wrote to memory of 4364 4836 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 146 PID 4364 wrote to memory of 1772 4364 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 147 PID 1772 wrote to memory of 2700 1772 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 148 PID 2700 wrote to memory of 2100 2700 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 149 PID 2100 wrote to memory of 1160 2100 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 150 PID 1160 wrote to memory of 2084 1160 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 151 PID 2084 wrote to memory of 3844 2084 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 152 PID 3844 wrote to memory of 4816 3844 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 153 PID 4816 wrote to memory of 4848 4816 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 154 PID 4848 wrote to memory of 692 4848 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 155 PID 692 wrote to memory of 4792 692 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 156 PID 4792 wrote to memory of 4208 4792 2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"7⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"8⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"9⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"10⤵
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"11⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"12⤵
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"13⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"14⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"15⤵
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"16⤵
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"17⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"18⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"19⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"20⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"21⤵
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"22⤵
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"23⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"24⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"25⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"26⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"27⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"28⤵
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"29⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"30⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"31⤵
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"32⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"33⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"34⤵
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"35⤵
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"36⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"37⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"38⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"39⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"40⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"41⤵
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"42⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"43⤵
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"44⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"45⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"46⤵
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"47⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"48⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"49⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"50⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"51⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"52⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"53⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"54⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"55⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"56⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"57⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"58⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"59⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"60⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"61⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"62⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"63⤵
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"64⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"65⤵
- Checks computer location settings
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"66⤵
- Checks computer location settings
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"67⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"68⤵
- Checks computer location settings
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"69⤵
- Checks computer location settings
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"70⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"71⤵
- Checks computer location settings
PID:376 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"72⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"73⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"74⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"75⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"76⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"77⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"78⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"79⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"80⤵
- Checks computer location settings
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"81⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"82⤵
- Checks computer location settings
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"83⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"84⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"85⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"86⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"87⤵
- Checks computer location settings
PID:440 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"88⤵
- Checks computer location settings
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"89⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"90⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"91⤵
- Checks computer location settings
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"92⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"93⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"94⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"95⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"96⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"97⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"98⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"99⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"100⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"101⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"102⤵
- Checks computer location settings
PID:624 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"103⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"104⤵
- Checks computer location settings
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"105⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"106⤵
- Checks computer location settings
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"107⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"108⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"109⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"110⤵
- Checks computer location settings
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"111⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"112⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"113⤵
- Checks computer location settings
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"114⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"115⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"116⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"117⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"118⤵
- Checks computer location settings
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"119⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"120⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"121⤵
- Checks computer location settings
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ccf0f1ec3ca041c9aca690548eab214a_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"122⤵PID:4120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-