Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/04/2026, 21:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe
- Size 770KB
- Sample260422-1bpdpscs7x
- SHA256 7f3fd1ed4dd6fd78e5943d8bd0f632539d604df6f46643de5c1290455ad23d44
- MD5 12e76784a83a3f0c58ac88a212976f93
- SHA1 51fcb64abbfd85b92a61ccb88fae216f410dcd8a
- SHA512 cd29419698fdfbac4475029838f3b5db287b993f0978c058e2ea7b94c59eee85b0e472c12619c951669f6dda9ec0850a59b7252b2ac2ca66a0b8e0646139513a
- SSDEEP 12288:NdN4fGjLKf/ZIClyBOUFKJaGMsL2rn65hYgiOXtCL:NFLKfhIClyBZGFQn652EdCL
- TLSH T12CF44A47F68D7BB9C4D9D238465FB222BE31BC480B22ABDB238466313D666D15F38354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (259) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe - Executes dropped EXE 3 IoCs
pid Process 2420 Logo1_.exe 3972 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 4428 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\RCXDF0F.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\RCXDF33.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.Exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\WeatherStub.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\RCXDF11.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXDF44.tmp Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\RCXDEEE.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXD326.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe Logo1_.exe File created C:\Program Files\7-Zip\7zG.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe Logo1_.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Solitaire.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe Logo1_.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.Exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe.Exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe File created C:\Windows\Logo1_.exe 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe 2420 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3452 wrote to memory of 4176 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 79 PID 4176 wrote to memory of 1964 4176 net.exe 81 PID 3452 wrote to memory of 2540 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 82 PID 3452 wrote to memory of 2420 3452 2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe 83 PID 2420 wrote to memory of 2740 2420 Logo1_.exe 85 PID 2740 wrote to memory of 5612 2740 net.exe 87 PID 2540 wrote to memory of 3972 2540 cmd.exe 88 PID 2420 wrote to memory of 1580 2420 Logo1_.exe 91 PID 1580 wrote to memory of 1968 1580 net.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:1964
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42D0.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe"3⤵
- Executes dropped EXE
PID:3972
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:5612
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1968
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4428
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXDCB8.tmp
- Size 94KB
- SHA256 0ba97d1ae2fbc4086af5b5d3ef246638e40e6e7261b692ae23b01f980dc2431a
- MD5 b707d03c2340e2fb8d914951c981d650
- SHA1 0ca3815f968e5fd62bca33300c6cff46e015cbdf
- SHA512 5e2e02c0fe8d081c02431d0a0fb8b8625b0bca0e5680b4ee96add9e038ef6daf531c0ee5f4291b16fc927c0c43d08855d85ad881d05985bdf6bab64406698838
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxDZ2HQuhtjRQX7ND:ACSjGoLpWM6VbBVjxDZ2wuhttQrp
- TLSH T1FA933A5AB28CB376D0F299BC8E0FF2E1BD353E200E1D199B75992F0DDE760C15518296
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXDEBD.tmp
- Size 103KB
- SHA256 fb7be5801cadc631d7c49bad771df3cb0e3ca6aa94a45ef12b857403bef63f98
- MD5 666b96e70a19f64b7b2ff0467672fd4c
- SHA1 cb0449c31db118242287f0784f3c7aa31ab82fd4
- SHA512 862f8565261ece2fb8a2af35d41c127c0c6883c57f4df28c8e67b0e0d5dc4aa775e7f36c0c32f0be36cb4e8e97c9f09e0283332ea7b2d4fd597f96efb0674f40
- SSDEEP 3072:YCSjGoLpWM6VbBVjx+Z2wuhttQcdtPlLqMu:uXq1Vt9RL0
- TLSH T1B3A36B5AB28DF772D0F29ABC8E0DF2D57D397D300E1A185BB69D1F0D9AB71C10908196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXDD8B.tmp
- Size 118KB
- SHA256 838cdd00888b93650980c37b0ccaedf6b5287d543465db207fb6cafc03fda169
- MD5 be49a615019dce2b45a03a7d090f1672
- SHA1 920e8781681102a04b1b75ebc2cbffdbd12c7750
- SHA512 26ac86ba7d7cc365c09759ad11746c07c2fdbb074311b8f6dbac193db2135d99b29928341d47d4fcfa828df6c01649d1c96b65ad84c56d525d2d2693f82f11bc
- SSDEEP 3072:FCSjGoLpWM6VbBVjxEZ2wuhttQPe5BV0LH:vXq1VX9ae5v0r
- TLSH T1C6C39D6AB28DF377C0F299B88E0DF2E57D357E301E29085BB5992F0DCA7B1C15518192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXE018.tmp
- Size 100KB
- SHA256 d20c77d277ca3dec12e9eafed27414ce2dda8e016a10ca441b40d5f65bde0b67
- MD5 13bdf35d2026f8d7c3cca812ed6e8ae5
- SHA1 2389e9bdbf4931b1e5b65a72a22acbee30b580f8
- SHA512 cb171f741747dc846b6ac560c2d86bc525c56734e7be6652c01dcded3481285d969348f32e3d0768e52c357d80533af6287b62e1b30568d237f94a0d430226a4
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxdZ2HQuhtjRQXeqkSZZZ34Nj:4CSjGoLpWM6VbBVjxdZ2wuhttQgU4J
- TLSH T13CA35A5AB68DB7B2D0F28AB88E0DF3E1BD357E300E59185BB29D3B0D9A770C1151C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 2756e082e854c013a4350e9b1d8e705b854106922b04f69087ae2902a60387f8
- MD5 47fb268d19a0e142997afae28faceedf
- SHA1 d484570ef9b3ad99565abc94e6ab1059ca2952fa
- SHA512 65254fa2b9cd7c0cc960dfef17825dc5b5de1cfab6772da05f8ab98076b9558e78303e17632297a445aec42345d69633403fde62e5b55abd9b61bc8147c596c1
- SSDEEP 12288:NUXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:NU0Le5ji0hmxNrM
- TLSH T1D1E4F816F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286876C6E676E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCXD00F.tmp
- Size 91KB
- SHA256 0b5f07a3c3bb9c3d570cee8dfde910d86b2fa7ffc7693d115e0ef766a53cd56c
- MD5 83aae770c364e0ec9b0d034635adc121
- SHA1 9e0826e807d570d371dc2ad299fc3202e6f7d135
- SHA512 c0eece3dad512963eac997e5c2a11164ccbc6023ca7fa6fb9822d48d9e41884600eaef1e3c87b4be18b121aaf44727f39a816be6dbae99e41aef32c80077499e
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxrZ2HQuhtjRQXENb:oCSjGoLpWM6VbBVjxrZ2wuhttQ0B
- TLSH T19B934B5AB28DB376D0F29AB88E0DF2E5BD393E301E19185BB69D2F0DDA771C1051C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXD110.tmp
- Size 92KB
- SHA256 5c6bf21bce4c7e4de760733795feb6c05d74c6aa7d5080a91d294592e929f3ce
- MD5 2aceecda6c2301047ecf1ca7cdf9227a
- SHA1 75cd8caa01c7ecaa279e2effc66e30e6181ae487
- SHA512 8c5b5409c7fae7922d508c646fdd01e9b29747c20280369637bc09311f47d531110f8574fb04f21e5129d211157c78904d31b5f61a021a23ac9aeb5be648118d
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxjZ2HQuhtjRQXJNL:wCSjGoLpWM6VbBVjxjZ2wuhttQZx
- TLSH T168934A6AB28CB376C0F299B88E0DF2E5BD357E300E19185BB59E3F1D9A771C1091C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe
- Size 4.3MB
- SHA256 afda5a02dccc283d2d73fd22837c3741cda7ece308530ce721bf75438527a4aa
- MD5 9b88f8d93666c9f0511547445fc1f438
- SHA1 0d1d48404fc8afa1ce286b658f908a10a845ad00
- SHA512 432deb7b82a466775f234ea3e9cd14e839fc7a175653b225ae400961c5f83d404ef944095976bab595c1c3e5091fff850d0a3f0e636e5e67dc432335d8de67da
- SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3TH/:JQvGAdlCEL8c/bRNw5CO
- TLSH T1C9263A656BEC91F5E0E7D134897A95B2FB7A7C020D32EB4B0151CA2F2F336904D29729
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE.Exe
- Size 554KB
- SHA256 5f4ebeaa2f089cfeffa33e6b504aca548828be8d34a8f1e6026993aefcbcee69
- MD5 f715a1174db762220e093c8c2e437674
- SHA1 9c62ce13dc70f85348e9ddf90c6463af962cf221
- SHA512 5bba94b5ace881cff8f4b4794219a38b9b42c48e5dd3703387649bce426630a5b4dd72a9b2672043ad4001998566d4a58968a45c98f18a3fb98b1ec2e7369280
- SSDEEP 6144:GXq1Ve9SzyiL7nVDcmdCI6BHAlSpFG/+Ls3ze30xLs+br0YzirzhafYmf7Pvm7Mo:q2DnVDcmd/6JAB/6N30xQ+hpvm7Mgj
- TLSH T1FFC4292132EDB318C8FB1B70DC3DB6812E767EA56D81C6AE29543B6D4D723428311B97
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCXE49D.tmp
- Size 92KB
- SHA256 9c4cf8e475a3984893098be99f86a75baa82d8de71e03b56df154edf2ab360e7
- MD5 ded7662341aa8a8d374bb4fd7f94b77d
- SHA1 7c3a000d9c4d845209a1c09829432a86609af76b
- SHA512 1a7b5f87069dcdd91f463088a3beb0a5956c29d18cb4cbb731ba2c4f418598d18adda968ac1c473abfc8589e0f20b898affc0e95dd9aee0b44f70ba6dd64155b
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxdZ2HQuhtjRQXxNr:YCSjGoLpWM6VbBVjxdZ2wuhttQhR
- TLSH T166934A6AB28DB776D0F299B88E0DF2E17D397E300E29185BB69D1F0DDE770C14918192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXE4DD.tmp
- Size 92KB
- SHA256 9b000a385cd96ba679abb805c8aa39a8225c86812db854cde748b05a0d5d14c0
- MD5 cf6ad8129d3212220748a14b19a7aa18
- SHA1 97169eb290cc7eb8dc254c9fe1b669bdb192369b
- SHA512 296bc77e2bd0e39c7a468064d776c9d4d2d0836c934c7ff7e88f950ddadf2407d845e8a9becaaa28c90202a2eb096c5e8d6d7a70888bd9f5ead60bc622aaab3d
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxDZ2HQuhtjRQXCZND:4CSjGoLpWM6VbBVjxDZ2wuhttQSZp
- TLSH T116934A6AF28CB776C0F299B88E0DF2E1BC297E304E29185B759D2F0DDE770D14918196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a42D0.bat
- Size 824B
- SHA256 a3ad098e7ab371e3c177b02654f79f1e13a4fb0307222793c8c36f2583594ee8
- MD5 711a1ae94280e73e9055fb915ccbddbd
- SHA1 a308146e53b9f49d7c52584a788f1c7e7623baac
- SHA512 e05f7b87bb93ef0faa7e2a62d18012d000ed8e44bcbbe95f4409ae6f1eab85b3daeb5d810fb07102c5c40ea775bf99b0973a4e83e80a521a7b8c518f2c4cf16c
- TLSH T1BC01A502C07BEBCE1424A89AC772AD8FC051755F674E32262340D51D85F6C19E4E1BD6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-22_12e76784a83a3f0c58ac88a212976f93_akira_cobalt-strike_elex_hijackloader.exe.exe
- Size 677KB
- SHA256 fb6c0990e4976b9a98320e0912842ec11aa380a0f237affd35ef9ad2e7667905
- MD5 9ffa3c77f872dbb0e850b2b2bf7719b6
- SHA1 20a022077000802d8aae7abddde9f0da96f31249
- SHA512 90b7aee4ca245b9681f2aaf228379d42bd062b70955c302d9162ccb7b7acaaf5f9ac20f6fdf65d9b5084c55afbcefd8273e19f0af7d950928d1ba5f68fd454fa
- SSDEEP 12288:kN4fGjLKf/ZIClyBOUFKJaGMsL2rn65hYgiOXtCL:QLKfhIClyBZGFQn652EdCL
- TLSH T123E46C43FAC51EA9C45AD33846579322B731BC481B32EBDB1384A6313D667E16F39398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 cc617e4627bf0a6c0dc362a46b44112f72d93a0707a2ad400a6b96753550120f
- MD5 60d13321ea86fdc71bf9ae6dea8e27de
- SHA1 5e7c781a3e7425fbee26497e6b4b7b746d3a8c62
- SHA512 6790067f7389dce43917c72f2f9523073e72cba672cee06f3afab15b6cd77bf52ce6c52f262c2aa948750c27544f5fdc13917f8102e4d45a9717b233528c5618
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeyVjxEZ2HQuhtjRQXwNcl:ACSjGoLpWM6VbBVjxEZ2wuhttQAKl
- TLSH T14C935B5AB28DB776D0F29AB88E0DF2E17D397E300E29185BB69D1F0DDE771C10918192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH