Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/04/2026, 21:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe
- Size 770KB
- Sample260422-1bpdpscs7x
- SHA256 7f3fd1ed4dd6fd78e5943d8bd0f632539d604df6f46643de5c1290455ad23d44
- MD5 12e76784a83a3f0c58ac88a212976f93
- SHA1 51fcb64abbfd85b92a61ccb88fae216f410dcd8a
- SHA512 cd29419698fdfbac4475029838f3b5db287b993f0978c058e2ea7b94c59eee85b0e472c12619c951669f6dda9ec0850a59b7252b2ac2ca66a0b8e0646139513a
- SSDEEP 12288:NdN4fGjLKf/ZIClyBOUFKJaGMsL2rn65hYgiOXtCL:NFLKfhIClyBZGFQn652EdCL
- TLSH T12CF44A47F68D7BB9C4D9D238465FB222BE31BC480B22ABDB238466313D666D15F38354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe - Executes dropped EXE 3 IoCs
pid Process 4568 Logo1_.exe 4524 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3900 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXA4FC.tmp Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{3B8CD807-514C-482B-86DE-B2334C53DC67}\MicrosoftEdge_X64_139.0.3405.125.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\RCX95C3.tmp Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA3FE.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RCXA66E.tmp Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXA5D9.tmp Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX9664.tmp Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXA5EA.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE.Exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\RCX99BD.tmp Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\RichDll.dll Logo1_.exe File created C:\Windows\uninstall\rundl132.exe 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe File created C:\Windows\Logo1_.exe 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe 4568 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4496 wrote to memory of 4312 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 85 PID 4312 wrote to memory of 5852 4312 net.exe 87 PID 4496 wrote to memory of 4432 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 88 PID 4496 wrote to memory of 4568 4496 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 89 PID 4568 wrote to memory of 4508 4568 Logo1_.exe 91 PID 4508 wrote to memory of 3384 4508 net.exe 93 PID 4432 wrote to memory of 4524 4432 cmd.exe 94 PID 4568 wrote to memory of 5236 4568 Logo1_.exe 97 PID 5236 wrote to memory of 3440 5236 net.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:5852
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a867.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe"3⤵
- Executes dropped EXE
PID:4524
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3384
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3440
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3900
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXA0D5.tmp
- Size 156KB
- SHA256 8912b8a335ad97de0ca936068d95ef5cb25eeb8fa9d017f35ef218aa7a8bb6c2
- MD5 924ae2d3dda7e0fbad7032d7f6827d2c
- SHA1 45af93c0b081885e40b7e11bd132e5511fd6d477
- SHA512 b84bdfe0d331aa558cc330fb48484acec5cbf56ab2ca7456ae64d54bb87689138df1267b598b11a75816239e9b539807df8bd289af63f0367f48e5741a0141d1
- SSDEEP 1536:E7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxkZ2HQuhtjRQXQNz:dCSjGoLpWM6VbBVjxkZ2wuhttQgZ
- TLSH T1FFF3B26EB18FB3F6C3E159BC8D1CF295ED29FE20CE19285A75D93B0E9A760C34508191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXA2DB.tmp
- Size 94KB
- SHA256 0ba97d1ae2fbc4086af5b5d3ef246638e40e6e7261b692ae23b01f980dc2431a
- MD5 b707d03c2340e2fb8d914951c981d650
- SHA1 0ca3815f968e5fd62bca33300c6cff46e015cbdf
- SHA512 5e2e02c0fe8d081c02431d0a0fb8b8625b0bca0e5680b4ee96add9e038ef6daf531c0ee5f4291b16fc927c0c43d08855d85ad881d05985bdf6bab64406698838
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxDZ2HQuhtjRQX7ND:ACSjGoLpWM6VbBVjxDZ2wuhttQrp
- TLSH T1FA933A5AB28CB376D0F299BC8E0FF2E1BD353E200E1D199B75992F0DDE760C15518296
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXA4FC.tmp
- Size 103KB
- SHA256 fb7be5801cadc631d7c49bad771df3cb0e3ca6aa94a45ef12b857403bef63f98
- MD5 666b96e70a19f64b7b2ff0467672fd4c
- SHA1 cb0449c31db118242287f0784f3c7aa31ab82fd4
- SHA512 862f8565261ece2fb8a2af35d41c127c0c6883c57f4df28c8e67b0e0d5dc4aa775e7f36c0c32f0be36cb4e8e97c9f09e0283332ea7b2d4fd597f96efb0674f40
- SSDEEP 3072:YCSjGoLpWM6VbBVjx+Z2wuhttQcdtPlLqMu:uXq1Vt9RL0
- TLSH T1B3A36B5AB28DF772D0F29ABC8E0DF2D57D397D300E1A185BB69D1F0D9AB71C10908196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA41E.tmp
- Size 118KB
- SHA256 838cdd00888b93650980c37b0ccaedf6b5287d543465db207fb6cafc03fda169
- MD5 be49a615019dce2b45a03a7d090f1672
- SHA1 920e8781681102a04b1b75ebc2cbffdbd12c7750
- SHA512 26ac86ba7d7cc365c09759ad11746c07c2fdbb074311b8f6dbac193db2135d99b29928341d47d4fcfa828df6c01649d1c96b65ad84c56d525d2d2693f82f11bc
- SSDEEP 3072:FCSjGoLpWM6VbBVjxEZ2wuhttQPe5BV0LH:vXq1VX9ae5v0r
- TLSH T1C6C39D6AB28DF377C0F299B88E0DF2E57D357E301E29085BB5992F0DCA7B1C15518192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXA735.tmp
- Size 100KB
- SHA256 d20c77d277ca3dec12e9eafed27414ce2dda8e016a10ca441b40d5f65bde0b67
- MD5 13bdf35d2026f8d7c3cca812ed6e8ae5
- SHA1 2389e9bdbf4931b1e5b65a72a22acbee30b580f8
- SHA512 cb171f741747dc846b6ac560c2d86bc525c56734e7be6652c01dcded3481285d969348f32e3d0768e52c357d80533af6287b62e1b30568d237f94a0d430226a4
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxdZ2HQuhtjRQXeqkSZZZ34Nj:4CSjGoLpWM6VbBVjxdZ2wuhttQgU4J
- TLSH T13CA35A5AB68DB7B2D0F28AB88E0DF3E1BD357E300E59185BB29D3B0D9A770C1151C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 2756e082e854c013a4350e9b1d8e705b854106922b04f69087ae2902a60387f8
- MD5 47fb268d19a0e142997afae28faceedf
- SHA1 d484570ef9b3ad99565abc94e6ab1059ca2952fa
- SHA512 65254fa2b9cd7c0cc960dfef17825dc5b5de1cfab6772da05f8ab98076b9558e78303e17632297a445aec42345d69633403fde62e5b55abd9b61bc8147c596c1
- SSDEEP 12288:NUXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:NU0Le5ji0hmxNrM
- TLSH T1D1E4F816F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286876C6E676E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCX95E4.tmp
- Size 91KB
- SHA256 0b5f07a3c3bb9c3d570cee8dfde910d86b2fa7ffc7693d115e0ef766a53cd56c
- MD5 83aae770c364e0ec9b0d034635adc121
- SHA1 9e0826e807d570d371dc2ad299fc3202e6f7d135
- SHA512 c0eece3dad512963eac997e5c2a11164ccbc6023ca7fa6fb9822d48d9e41884600eaef1e3c87b4be18b121aaf44727f39a816be6dbae99e41aef32c80077499e
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxrZ2HQuhtjRQXENb:oCSjGoLpWM6VbBVjxrZ2wuhttQ0B
- TLSH T19B934B5AB28DB376D0F29AB88E0DF2E5BD393E301E19185BB69D2F0DDA771C1051C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX96E4.tmp
- Size 92KB
- SHA256 5c6bf21bce4c7e4de760733795feb6c05d74c6aa7d5080a91d294592e929f3ce
- MD5 2aceecda6c2301047ecf1ca7cdf9227a
- SHA1 75cd8caa01c7ecaa279e2effc66e30e6181ae487
- SHA512 8c5b5409c7fae7922d508c646fdd01e9b29747c20280369637bc09311f47d531110f8574fb04f21e5129d211157c78904d31b5f61a021a23ac9aeb5be648118d
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxjZ2HQuhtjRQXJNL:wCSjGoLpWM6VbBVjxjZ2wuhttQZx
- TLSH T168934A6AB28CB376C0F299B88E0DF2E5BD357E300E19185BB59E3F1D9A771C1091C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE.Exe
- Size 554KB
- SHA256 5f4ebeaa2f089cfeffa33e6b504aca548828be8d34a8f1e6026993aefcbcee69
- MD5 f715a1174db762220e093c8c2e437674
- SHA1 9c62ce13dc70f85348e9ddf90c6463af962cf221
- SHA512 5bba94b5ace881cff8f4b4794219a38b9b42c48e5dd3703387649bce426630a5b4dd72a9b2672043ad4001998566d4a58968a45c98f18a3fb98b1ec2e7369280
- SSDEEP 6144:GXq1Ve9SzyiL7nVDcmdCI6BHAlSpFG/+Ls3ze30xLs+br0YzirzhafYmf7Pvm7Mo:q2DnVDcmd/6JAB/6N30xQ+hpvm7Mgj
- TLSH T1FFC4292132EDB318C8FB1B70DC3DB6812E767EA56D81C6AE29543B6D4D723428311B97
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VideoLAN\VLC\vlc.exe.Exe
- Size 1.0MB
- SHA256 4a932bcf9dae2911e613e5b9c66420cdb8560aa2d7cb8e102837b1b9e24ebf5b
- MD5 73403f33427dca7019198c8ba3954dd7
- SHA1 fb08a1b142f08d5a20c4240320b9aa81f54fa4c4
- SHA512 615b388a457edd5ec66209d9ad599a8eb380503d4ee95a17fdfc309651e472877e3fae877cff521c1bbb0a78c50f520ad8998fd03a08c988a69b0ff278474e60
- SSDEEP 24576:qQe3xAibB85Z1HrWtB8z1L1O6J75zzz3zzzozzz3zzzzm:AxAibBEZ1LWtBzkOm
- TLSH T1BE353A1BE2AE77E9C5EFC034879EF7716E30BC5902247E2E2955D7222E10D509B2E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a867.bat
- Size 823B
- SHA256 a048a18062f2dca4bd5a0e2254027869a97f8612f1680ed65ad1437d26033948
- MD5 2f2e1db067fcda4fe6a6b23c4db1735c
- SHA1 ec2ddc676edd0c5f3c2b1925393bbce9b49b2718
- SHA512 e470d67a47687799cfeee2f26ba32ff323635b1685fe534c145878a728b9672f7039b17c2e2c96f06204995d8abe638ce5ac4f4b90ca8d2cb8360187dbb41659
- TLSH T14B01A502C07BEBCE1424A89AC772AD8FC051755F674E32262340D51D85F6C19E4E1FD6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe.exe
- Size 677KB
- SHA256 fb6c0990e4976b9a98320e0912842ec11aa380a0f237affd35ef9ad2e7667905
- MD5 9ffa3c77f872dbb0e850b2b2bf7719b6
- SHA1 20a022077000802d8aae7abddde9f0da96f31249
- SHA512 90b7aee4ca245b9681f2aaf228379d42bd062b70955c302d9162ccb7b7acaaf5f9ac20f6fdf65d9b5084c55afbcefd8273e19f0af7d950928d1ba5f68fd454fa
- SSDEEP 12288:kN4fGjLKf/ZIClyBOUFKJaGMsL2rn65hYgiOXtCL:QLKfhIClyBZGFQn652EdCL
- TLSH T123E46C43FAC51EA9C45AD33846579322B731BC481B32EBDB1384A6313D667E16F39398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 cc617e4627bf0a6c0dc362a46b44112f72d93a0707a2ad400a6b96753550120f
- MD5 60d13321ea86fdc71bf9ae6dea8e27de
- SHA1 5e7c781a3e7425fbee26497e6b4b7b746d3a8c62
- SHA512 6790067f7389dce43917c72f2f9523073e72cba672cee06f3afab15b6cd77bf52ce6c52f262c2aa948750c27544f5fdc13917f8102e4d45a9717b233528c5618
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxEZ2HQuhtjRQXwNcl:ACSjGoLpWM6VbBVjxEZ2wuhttQAKl
- TLSH T14C935B5AB28DB776D0F29AB88E0DF2E17D397E300E29185BB69D1F0DDE771C10918192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH