Analysis
- max time kernel
149s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/04/2026, 03:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe
- Size 770KB
- Sample260419-ea7m1ahs7v
- SHA256 250073027122e047e1df8d3588c02f4b7e74def4f553f7423793c28e46707364
- MD5 8572c65171cbb7fb1af91c5922abff41
- SHA1 674ba335dfe93ffd9243d37c50e47d17a1735896
- SHA512 03057901b184c6a9dbb8585366729ac5e8b590ac1b0bac87cbbcc54f903b8a07ea5579da71c778f46da3d4c4f09c25084c302a9c08ab4ae212667e4b9b31f174
- SSDEEP 12288:ZN4fGjLKf/ZIClyBOUFKJaGMsL2rn65hYgiOXtCL:hLKfhIClyBZGFQn652EdCL
- TLSH T136F44A47F68D7BB9C4D9D238465FB222BE31BC480B22ABDB238466313D666D15F38354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (255) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe - Executes dropped EXE 3 IoCs
pid Process 3856 Logo1_.exe 4936 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 3784 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RCXB1E8.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXC011.tmp Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe.Exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\RCXBEE4.tmp Logo1_.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe File created C:\Windows\Logo1_.exe 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe 3856 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4728 wrote to memory of 4732 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 84 PID 4732 wrote to memory of 2104 4732 net.exe 86 PID 4728 wrote to memory of 4636 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 87 PID 4728 wrote to memory of 3856 4728 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 89 PID 3856 wrote to memory of 4444 3856 Logo1_.exe 90 PID 4636 wrote to memory of 4936 4636 cmd.exe 92 PID 4444 wrote to memory of 4984 4444 net.exe 93 PID 3856 wrote to memory of 6088 3856 Logo1_.exe 96 PID 6088 wrote to memory of 824 6088 net.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:2104
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a213F.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe"3⤵
- Executes dropped EXE
PID:4936
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4984
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:824
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3784
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXBBEE.tmp
- Size 156KB
- SHA256 9a7c2aa86894ba443a5bb542e4f2806f09e5877fec2b8005b0055e8816f134b7
- MD5 d78e93fb6833da471bf0194620d48350
- SHA1 c299785e98d909c5f6b9cc4a759612adc32f7156
- SHA512 9a3b6e9e7283e62363feb24af750c41c3669d5dda9b1f2a71e79a11cbfa8f82c7f6d49596977152687c68ad86a15230ba45c8ab9071875e0596ec66583d12f78
- SSDEEP 1536:w7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx58SXzpn9t6RNz:hCSjGoLpWM6VsBEjx5ZdMZ
- TLSH T1C5F3B36EB18FB3F6D3E1597C8D1CF2A5ED28FE20CE19285B75993B0E9A760C31508191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXBE43.tmp
- Size 94KB
- SHA256 d8d93131073755f109a310d912b7cc1bf5987ba277d9906c58a6df1698059270
- MD5 b5ea458299f2908c03a9e9301eeb06ad
- SHA1 9b6a82115e9302fecf1444cb7abc9d0f4b6ba5e0
- SHA512 0494aee7cd955487c5e637f874a4feb839123e60c6a580eff43cad4864a595f16cbbb1fee2080aeda1e1199a0e48298b04c7a47832f6542a23a8e716bbed468d
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CND:gCSjGoLpWM6VsBEjx+ZdTp
- TLSH T150932A5AB18CB376D0E159BC8E0FF2E5BD297E200E1D589FB59A2F0DEE760C1590C285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.Exe
- Size 5.8MB
- SHA256 26c55cda3bc8eba846f0dfb87707e177af3bfcc64c5e5288ee43e621b1649b00
- MD5 a72fb44fd97ce8011b312d5a28f08a02
- SHA1 2ad0255f27bb65aa95bff22e1f97e37985743919
- SHA512 8637b58773217c73b9e02fb3bb8d27c835bd87c31f97166f717063fbba550580c9846b1bb3efd0755c26da1dd8ce0fad029404e1fb79fcbbf00771deb903c29f
- SSDEEP 98304:+og5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7ws:+og1P9fIlOuz6IgF+I3m2MXP6HG8Qzb
- TLSH T165567B23A4E46130E5F332756D2CA7395D327FA29F3145CB86906C946FB82D3293936B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXC14E.tmp
- Size 103KB
- SHA256 742b2019651362fe67da7a19288776610f4253de8760ea42bd14c35e66d63112
- MD5 824bcac149ab8169e282952735c8fbbd
- SHA1 c83e62d85c90474edb845f5cb7ddb87035ae91be
- SHA512 728af4660e195ac508828918ea3e4b2b8aaefacb74c856289d0572e731115c30bc54b92817a2ffd4ec663d951a729fb328b9928411b172ed59c557f4d6f5e38e
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx78SXzpn9t6M1XkSPsULMHiENQ:gCSjGoLpWM6VsBEjx7ZdddtPlLqdu
- TLSH T132A37C59B28DB376D0E249BC8E0DF2E5BD387E300F1A185FB69E2F0D9A765C1190C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXC041.tmp
- Size 1.9MB
- SHA256 51fd21535f44d2946f04ea21eb6082d2503d1ed655258efeec065e42f6d67873
- MD5 06ffce2b8c73c02a1fb1dd6419e855ea
- SHA1 30536faceae81e16c0f0e5b7d75ea14f988c9c89
- SHA512 ab1aa2219fc74a5ca884101ac25a7bc4c0afaea61aac91270051934c15d5c18018f92647c068e59a9b4ed0816bc75b3ee7f26a47e271ecbc18c379fba4b14cac
- SSDEEP 24576:Xt5kAGu6McqpA7D9ruO3O7Q7OBLLMdus7CtW7KSdHBxmRkkkkkkklQXBysWAb:dZGu6qG13O7Q7gLYduZrSdHBAVfb
- TLSH T14A956B03F69DA3A5D0D9C2B8CB2EB725DE617C554F2066DF02807A652E77AD04B3D390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 9c7b0a2a82b56fef2b494c76c4b45c77ecf827950d60dd5c4d226903b1b9f78e
- MD5 dfcf7e6e3f625a8f668a42a8c2926184
- SHA1 0e31e5c38e57fbd0f815833653554e062812cad0
- SHA512 b32bc3a6e08b5d75e032a74266b8ed592d2331640ad6cbecab910fe8fc970616b07f352d19d0694746935a322257dce55ce7de2d0140e1782d21fe903c76774e
- SSDEEP 6144:mXqoE2hXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ8F:IXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
- TLSH T1D4E4F716F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286876C6E676E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXB039.tmp
- Size 92KB
- SHA256 e96d91c42307a0306bcfc6492584e422806e1bc8e8c2f71686233cd08d6485b2
- MD5 db4f7a8956ddbbf01a12c4156e27d215
- SHA1 c7f4b1a41af9e29afa1ddc4a1987f5b1765fa4b6
- SHA512 899a12cb2cb2eb5cf1e90fafaafa15360af89b8c4809d3cc3b72e08f26c2861ae39f78e5e1a6eee728435f2f619b816728d22ea807e8bbb2a314a668b2e12137
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t6kNL:gCSjGoLpWM6VsBEjxeZdJx
- TLSH T1F6935C6AB29CB376D0E159B88E0DF2E5BD397E300E19185BB1AE3F1DDA771C1190C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCXB37A.tmp
- Size 91KB
- SHA256 a34c478094d879ccd639c3fdebc5daeaf0f854d2b38ff3f62d4f3c43774ec551
- MD5 6b7a2e18b17d12279fd38e5cdff63f73
- SHA1 0a7590ae66954aaeb3c28bb01ae1ec6b594c7672
- SHA512 55b8aa94e9bb2d51ee6c1fea3ee6062a0d3ccfcb83af3d29eb424d9b4b254d57315ce9f2789642943d2470dcc4609ce776a5bf67b31fd5fc6a4432092882b759
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t6/NL:YCSjGoLpWM6VsBEjxmZdGx
- TLSH T181935C59B28CB376D0F259B88E0DF2E5BD297E300F1A185BB5EE2F1DDA7A1C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\RCXB3BA.tmp
- Size 100KB
- SHA256 9dcc53ffac89bd4a5d65f07e3506a7bf2716e69fdf30765fbc11361ec114a5be
- MD5 0866e5f6f092812c67b82734433075f1
- SHA1 b7ab972a8758c92f9a03843738b041e7c7aee6e2
- SHA512 575cc4f75f6034f3f69d4167256dea51227c9ccbc7df3fae07a63a269e74780a01ac42ad991aad121cb6b627a4fc87a8716b96145d2fe05ef18740bf528d5b5a
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6eqkSZZZ3JNj:oCSjGoLpWM6VsBEjxQZdJUJJ
- TLSH T186A35B1AB68CB3B6D0F189B89D0DF3E5BD397E300E59185FB2AD3B1E9A77081190C195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VideoLAN\VLC\vlc.exe.Exe
- Size 1.0MB
- SHA256 f16204ea3dc371b62cffa51904d2b32967b11fd5f0f7e5d39f3602606923edae
- MD5 f3fa6f9b9cc7aab6ab836223252ef8bc
- SHA1 7b82dda88d39889093994ce70c44b299a3edd7a3
- SHA512 4161b9b1421ce1cf77513e35b2f58bc6a8a504a1940e54a81a837d58dbc7bd58269cf81f527d1ae42ac61e4942e697fe8da0839b6a5b1e44fedda6ecf65d2752
- SSDEEP 24576:+e3xAibB85Z1HrWtB8z1L1O6J75zzz3zzzozzz3zzzzm:FxAibBEZ1LWtBzkOm
- TLSH T1EE353A1BE2AE77E9C5EFC034879EF7716E30BC5902247E2E2955D7222E10D509B2E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCXC80D.tmp
- Size 545KB
- SHA256 869f9c41102cf9c89ae1dbe3efa10817d993678021ecfc7552e992c245eacf12
- MD5 2ca6a881176554c8d732fa7e2a9d1e81
- SHA1 b94f7e05fa972d766dedf1389eff83d585e526c7
- SHA512 c9633db255d2577093efa51580471bbe1b2fbd7516a633f6f83e1de7c841f58f365f1ed780b9f0661521d64d21ef527a53129b5f694ce430474ef55ca3883941
- SSDEEP 6144:+XqoEwQ78n5Qw0tneDA/sqhleIc0HftDrkYY1hj63hgDonsogCh6NEpAFM:b85bM3npxYfj63hgD1ZiL
- TLSH T1E6C4D50277EDB335F1F31B31AE7DB2615E7ABC619D35860E23841A0D49B0980EA75B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a213F.bat
- Size 824B
- SHA256 19dbfc5e3d31ec54a14258d298454c66e8f99ff9414733e1bef8820928f3312e
- MD5 3ee9e4de19d9f3649dd7667e639a1757
- SHA1 1f055aae8769131d41d0506e2e2942ae5312f98a
- SHA512 45b9b501c588102bc88dd37e176fa0d204c38e427d4d8143717108be72131cd99ad0c3556c0dc962c2f12bc437ed3563c6de9c63063fd192666dee67bbc2f8b8
- TLSH T14001804284BBF68E0918B56F85765F8F9016751F270E3B268396908DE0C4D4EF8AA7C7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe.exe
- Size 677KB
- SHA256 fb6c0990e4976b9a98320e0912842ec11aa380a0f237affd35ef9ad2e7667905
- MD5 9ffa3c77f872dbb0e850b2b2bf7719b6
- SHA1 20a022077000802d8aae7abddde9f0da96f31249
- SHA512 90b7aee4ca245b9681f2aaf228379d42bd062b70955c302d9162ccb7b7acaaf5f9ac20f6fdf65d9b5084c55afbcefd8273e19f0af7d950928d1ba5f68fd454fa
- SSDEEP 12288:kN4fGjLKf/ZIClyBOUFKJaGMsL2rn65hYgiOXtCL:QLKfhIClyBZGFQn652EdCL
- TLSH T123E46C43FAC51EA9C45AD33846579322B731BC481B32EBDB1384A6313D667E16F39398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 843eee5d0b6cc8c034d3cac5c60d955d4a92165c04a7ef56f817d88d785032c2
- MD5 bf78799b0db1d3d6d4f2e81ffb8435cf
- SHA1 7f9cde107519fec032714655f8e6c99cb2a9e10f
- SHA512 4fb2ceb5241e3b4f22271ac04cb16865d7f4f9fd6c0b57abdfc5df2514844962449c4604932ea17d3a2e5174dcf6b6facd59f055afe51fcf4082eafee275fdbf
- SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t6QNN:QCSjGoLpWM6VsBEjxGZdRj
- TLSH T138935B5AB28DB376D0E259B88E0DF2E5BD397E300F1A185FB5AE2F0DDA761C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH