Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
19/04/2026, 03:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe
- Size 770KB
- Sample260419-ea7m1ahs7v
- SHA256 250073027122e047e1df8d3588c02f4b7e74def4f553f7423793c28e46707364
- MD5 8572c65171cbb7fb1af91c5922abff41
- SHA1 674ba335dfe93ffd9243d37c50e47d17a1735896
- SHA512 03057901b184c6a9dbb8585366729ac5e8b590ac1b0bac87cbbcc54f903b8a07ea5579da71c778f46da3d4c4f09c25084c302a9c08ab4ae212667e4b9b31f174
- SSDEEP 12288:ZN4fGjLKf/ZIClyBOUFKJaGMsL2rn65hYgiOXtCL:hLKfhIClyBZGFQn652EdCL
- TLSH T136F44A47F68D7BB9C4D9D238465FB222BE31BC480B22ABDB238466313D666D15F38354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (256) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 3 IoCs
pid Process 2752 Logo1_.exe 1492 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 2292 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleApp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\RCXD7EC.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.Exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\RCXE6BE.tmp Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXD86E.tmp Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXE492.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXDA54.tmp Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe File created C:\Windows\uninstall\rundl132.exe 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe File created C:\Windows\Logo1_.exe 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe 2752 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5948 wrote to memory of 4988 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 79 PID 4988 wrote to memory of 5012 4988 net.exe 81 PID 5948 wrote to memory of 3452 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 82 PID 5948 wrote to memory of 2752 5948 2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe 83 PID 2752 wrote to memory of 2112 2752 Logo1_.exe 85 PID 3452 wrote to memory of 1492 3452 cmd.exe 87 PID 2112 wrote to memory of 3708 2112 net.exe 88 PID 2752 wrote to memory of 4636 2752 Logo1_.exe 91 PID 4636 wrote to memory of 6016 4636 net.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:5012
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A81.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe"3⤵
- Executes dropped EXE
PID:1492
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3708
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:6016
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2292
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe
- Size 1.2MB
- SHA256 6f7fd5edc38b77b3e847eeefc9c20a998a78d0a53f6ae857daea222533183481
- MD5 a5a384fc72829609925ab2dd53126915
- SHA1 6c979b8ab58c0d0fe813f601f098b0ae969b2643
- SHA512 62f5c6f8e5c4be80165f3e51da31dbb3e9470a37b2489bad68bdbf8bba514727ea1d4ac8e41f42fac0768d24288b95768128de4f931d71e18eed82b8d1d43c6c
- SSDEEP 12288:F3Sgouvz0ZRHkXVfeeO4LMneqyQsWSjGQCfLBlS7guN1AnQ6i12NI+f:dSgouvz0ZRHkFfenxyQZXS7gZnQh2NIq
- TLSH T12555C40267FD7329F1F37B71EABDB2645E767C61AE39C50E5284025E09B0A909A31733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\RCXE401.tmp
- Size 91KB
- SHA256 a567f4fffbd1b33867124e6531d2ee8b2982125a638c75da7b43e2e1c125a776
- MD5 77aa0e1977f476efc8737feb5addcf39
- SHA1 47efb029f65428bff0a5baa6711374424e6ab741
- SHA512 2d690182436ceb17be9ec6590d0dde7f11b9b9d3b68d43c5029d3c8b8b873565490baae3a5a6d930a5d4fd615fe5cdf11ae5e449375c8657ab5c1dc7f2e6e8dc
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6xNT:YCSjGoLpWM6VsBEjxZZdM5
- TLSH T12C935C6AB28DB376D0E299B88E0DF2E5BD397E300F19185FB59E2F0DDA761C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXE5B2.tmp
- Size 103KB
- SHA256 742b2019651362fe67da7a19288776610f4253de8760ea42bd14c35e66d63112
- MD5 824bcac149ab8169e282952735c8fbbd
- SHA1 c83e62d85c90474edb845f5cb7ddb87035ae91be
- SHA512 728af4660e195ac508828918ea3e4b2b8aaefacb74c856289d0572e731115c30bc54b92817a2ffd4ec663d951a729fb328b9928411b172ed59c557f4d6f5e38e
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx78SXzpn9t6M1XkSPsULMHiENQ:gCSjGoLpWM6VsBEjx7ZdddtPlLqdu
- TLSH T132A37C59B28DB376D0E249BC8E0DF2E5BD387E300F1A185FB69E2F0D9A765C1190C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXE492.tmp
- Size 118KB
- SHA256 8dce519c0690c2fa257e999e00e35081798ddc0f5ee942851cc6e12ebaca008d
- MD5 d4917f64840ab1fd15b57517c950c81f
- SHA1 f13717c532d14a28eedc6674b376169b938737f6
- SHA512 96a28e2bd0980b198600aa7074aab85dbfe7afc6194edd0dcec525dc36a6cea8e190d59b692c71024657030d9a9364cb60f2ae0bd26c7ae878b751df36c0427c
- SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6x4GZjzQwK5WW7VCn6:JCSjGoLpWM6VsBEjxZZdQe5BV0yH
- TLSH T1B9C3AE6AB6CCB377C0E259B84E0DF2E57D697E300E19085FB59A2F0DCA7B5C1590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 9c7b0a2a82b56fef2b494c76c4b45c77ecf827950d60dd5c4d226903b1b9f78e
- MD5 dfcf7e6e3f625a8f668a42a8c2926184
- SHA1 0e31e5c38e57fbd0f815833653554e062812cad0
- SHA512 b32bc3a6e08b5d75e032a74266b8ed592d2331640ad6cbecab910fe8fc970616b07f352d19d0694746935a322257dce55ce7de2d0140e1782d21fe903c76774e
- SSDEEP 6144:mXqoE2hXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ8F:IXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
- TLSH T1D4E4F716F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286876C6E676E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXD8DF.tmp
- Size 92KB
- SHA256 e96d91c42307a0306bcfc6492584e422806e1bc8e8c2f71686233cd08d6485b2
- MD5 db4f7a8956ddbbf01a12c4156e27d215
- SHA1 c7f4b1a41af9e29afa1ddc4a1987f5b1765fa4b6
- SHA512 899a12cb2cb2eb5cf1e90fafaafa15360af89b8c4809d3cc3b72e08f26c2861ae39f78e5e1a6eee728435f2f619b816728d22ea807e8bbb2a314a668b2e12137
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t6kNL:gCSjGoLpWM6VsBEjxeZdJx
- TLSH T1F6935C6AB29CB376D0E159B88E0DF2E5BD397E300E19185BB1AE3F1DDA771C1190C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\RCXDA97.tmp
- Size 156KB
- SHA256 3bdd2ebe6b1ab9c29bd4233fcae02b53faa23b5c97d5389635a551f4038d2c76
- MD5 db7843f37efedef542cb6333b46dbf2d
- SHA1 875aa8a3fc4df243d823506623e136e5f0b53ca8
- SHA512 84d9786c26d6c6346eaf35b551a31559a3459150ede71fdb16b119ba8f47f95edca678209149d72b6f5dcbf73066234dadaa77cbb0b3f51933d497a8d873bdde
- SSDEEP 1536:w7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx58SXzpn9t6Pn2Nz:hCSjGoLpWM6VsBEjx5Zds2Z
- TLSH T101F3D576B25CB776E0E199B84E0DF1E1AC6D7E201E1BCC6A715A3F0DBB761C11A0818D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCXDAD8.tmp
- Size 91KB
- SHA256 a34c478094d879ccd639c3fdebc5daeaf0f854d2b38ff3f62d4f3c43774ec551
- MD5 6b7a2e18b17d12279fd38e5cdff63f73
- SHA1 0a7590ae66954aaeb3c28bb01ae1ec6b594c7672
- SHA512 55b8aa94e9bb2d51ee6c1fea3ee6062a0d3ccfcb83af3d29eb424d9b4b254d57315ce9f2789642943d2470dcc4609ce776a5bf67b31fd5fc6a4432092882b759
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t6/NL:YCSjGoLpWM6VsBEjxmZdGx
- TLSH T181935C59B28CB376D0F259B88E0DF2E5BD297E300F1A185BB5EE2F1DDA7A1C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe.Exe
- Size 1.4MB
- SHA256 6e782b56b3a89fcd2b842061c4ed8362579096b309e7f290cf03f8aa4d839e5f
- MD5 a805b61944a7f4a3facb399d4edf33bb
- SHA1 3a02e86215170e2d281d7092282beb00ec8f7880
- SHA512 a50c446908d58f4ff58e79fcdbb9e46d0e5e7673e8c33af44a73958213cceed30b8923b4eaf73503993e7150971a175b56ffb6c360fedf1df89e1785b0722628
- SSDEEP 12288:qUbTyUjD5xN9euP+bnEPKSjlSoRUJDJ095+B7a2SooEP2WKtsm45c:7TTHhmbEPKSjIov0BW1oZP21tT45c
- TLSH T116655B01A79CFB32D8EA493078BCF7262F35BD916F51C6B7331AB25C4E71351996820A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXEB55.tmp
- Size 92KB
- SHA256 37f384e354898f55e655ff5edaaec13a4fe6ed2b962e5962d68a9477d15e95aa
- MD5 89cf80f31cc081cfed9cc8f9142de5fa
- SHA1 c775d8f7028385418a5a2c7c7636dfc3948cdfaf
- SHA512 6cdbadbe00ceae25525d8ea9bc021550aad928ff2ac64f90de8ec79f8e4a82e37bd41a1c3e67adab2436ab6c1dd2ac2c8d1b344a4bea8c5638c60092221ff10f
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6CUND:YCSjGoLpWM6VsBEjx+ZdDUp
- TLSH T18F936C6AF29CB376D0F299B88E0DF2E5BC297E304E19185B759E2F0DDA770C1590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a4A81.bat
- Size 824B
- SHA256 ee64a79a92d9908b51138b4fa3f35ac10fcdb7b69d274e81a12d195a0c4eac58
- MD5 437a26752ab38222c772cfb1e33b6ff8
- SHA1 9af5bed7e6c39e6696889c65dde492f53e4116ca
- SHA512 6867b076f8322a43f1f8fbcfefc1d6d0632c3d05ddd7ce98bbd4eaff2f450ab3e1df5a62ee82c6a3af4b91ed855cc1d7bea340ad751a4592e361b7ea1a374aff
- TLSH T16901800284BBF68E0918B56F85765F8F9016751F270E3B268396908DE0C4D4EE8AA7C7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-19_8572c65171cbb7fb1af91c5922abff41_akira_cobalt-strike_elex_hijackloader.exe.exe
- Size 677KB
- SHA256 fb6c0990e4976b9a98320e0912842ec11aa380a0f237affd35ef9ad2e7667905
- MD5 9ffa3c77f872dbb0e850b2b2bf7719b6
- SHA1 20a022077000802d8aae7abddde9f0da96f31249
- SHA512 90b7aee4ca245b9681f2aaf228379d42bd062b70955c302d9162ccb7b7acaaf5f9ac20f6fdf65d9b5084c55afbcefd8273e19f0af7d950928d1ba5f68fd454fa
- SSDEEP 12288:kN4fGjLKf/ZIClyBOUFKJaGMsL2rn65hYgiOXtCL:QLKfhIClyBZGFQn652EdCL
- TLSH T123E46C43FAC51EA9C45AD33846579322B731BC481B32EBDB1384A6313D667E16F39398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 843eee5d0b6cc8c034d3cac5c60d955d4a92165c04a7ef56f817d88d785032c2
- MD5 bf78799b0db1d3d6d4f2e81ffb8435cf
- SHA1 7f9cde107519fec032714655f8e6c99cb2a9e10f
- SHA512 4fb2ceb5241e3b4f22271ac04cb16865d7f4f9fd6c0b57abdfc5df2514844962449c4604932ea17d3a2e5174dcf6b6facd59f055afe51fcf4082eafee275fdbf
- SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t6QNN:QCSjGoLpWM6VsBEjxGZdRj
- TLSH T138935B5AB28DB376D0E259B88E0DF2E5BD397E300F1A185FB5AE2F0DDA761C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH