Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/08/2026, 19:35
Behavioral task
behavioral1
Sample
2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe
- Size 1.3MB
- Sample260827-ya4e5azgle
- SHA256 49481b5d373ad60eb9540bbdc9daa942f220a5caa01f90b02a28cb75e2037aa9
- MD5 3878a6cb83aef2f593e7dd404f54089f
- SHA1 7c8a6cd35da82cd231e0b6f387f68592e06de589
- SHA512 f7bf83aa76bb049316be07461f9d4ceb2fe979411311da245f4f9f137b66085d69182dbfbe91b7c5c92e90b225507f1ca26f5170afc53a9489434f2e608df9d1
- SSDEEP 24576:BLKfhIClyBZGFQn652EdCN0Le5ji0hmxNrM8:BuyBZ92iPji0Ajt
- TLSH T19D554917F6A44B75D066C279C6D3A656FA3138490B31DBCB038497383E677E29E3A320
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\xwizard.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\msra.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\sfc.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\at.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\reg.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\sudo.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\find.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\raserver.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\control.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\explorer.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\psr.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\timeout.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\reg.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\mode.com- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\choice.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\expand.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SysWOW64\clip.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe -
resource yara_rule behavioral2/memory/5608-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000300000001b2cc-5.dat upx behavioral2/memory/5608-1034-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/5608-2912-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Windows Defender\MpDlpService.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{ECECEC7E-D0D4-455B-8F24-7676AF0A59FB}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1150_none_b21dc6dde1913832\r\winrshost.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.26100.1_none_783b330506082901\backgroundTaskHost.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_196dbbee022bb530\r\SpeechModelDownload.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\uwfux.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\r\aspnetca.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.26100.1591_none_a6992e1af01c7fb5\r\SppExtComObj.Exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.26100.1591_none_4ab0905276b69755\r\CheckNetIsolation.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.26100.712_none_b7b410b79e222f1d\r\imjpuexc.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_4.0.15912.0_none_447f4612d8b724d2\AddInProcess32.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\r\AccountsControlHost.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..client-ui-wscollect_31bf3856ad364e35_10.0.26100.1_none_06a70fed9a123232\WSCollect.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.26100.1150_none_8b65f13ba864c9e1\sysprep.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\rdpshell.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1_none_9e9d7dbf35638ca0\WMIC.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-makecab_31bf3856ad364e35_10.0.26100.1_none_f817d499062c355e\makecab.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.26100.1150_none_59491cddd00c2dba\smartscreen.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\SearchProtocolHost.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.26100.1150_none_1da178eaf53e7c4d\r\PrintBrmEngine.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.26100.1_none_713b7d7638176261\TapiUnattend.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.26100.1_none_a454f54474148daf\dpnsvr.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ribbons_31bf3856ad364e35_10.0.26100.1150_none_249c3478d7e5d3ca\r\Ribbons.scr- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_wcf-comsvcconfig_b03f5f7f11d50a3a_10.0.26100.1_none_22beb1f66a9bdcd9\ComSvcConfig.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-where_31bf3856ad364e35_10.0.26100.1_none_651b8bd27b17ef87\where.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.26100.1591_none_1f650d1288a260be\UserAccountControlSettings.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1150_none_3d9125d57cc0da9e\WMIC.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.26100.1_none_3182dffdaeb31123\SrTasks.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_netfx-dfsvc_b03f5f7f11d50a3a_10.0.26100.1_none_6694132cb1b96a0b\dfsvc.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6bac5cbeaae00b9d\tttracer.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\r\SearchFilterHost.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\splwow64.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.26100.1_none_261d19c21491b907\quser.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpDlpService.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.27000.360_none_ec5dcd352cf057e6\aspnet_regbrowsers.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\SearchHost.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\x86_aspnet_compiler_b03f5f7f11d50a3a_10.0.26100.1_none_bd06c5e20c19d210\aspnet_compiler.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\x86_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15912.0_none_c07bc1454a24c3d8\csc.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.26100.1591_none_9c7590519bc81879\vfpctrl.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\TiWorker.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-recover_31bf3856ad364e35_10.0.26100.1_none_8d5ba08151885bf2\recover.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_7e19f7088f522c23\rundll32.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_edmgen_b77a5c561934e089_4.0.15912.0_none_b064199c91afa844\EdmGen.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_10.0.26100.1_none_d80a0abbc02dc6d0\InstallUtil.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_netfx35linq-addinutil_31bf3856ad364e35_10.0.26100.1_none_c811e1884be875a8\AddInUtil.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1_none_36c64bb72fffb46a\Dism.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_d07e775d9a3de1d6\r\CapturePicker.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.26100.1_none_3498f416009e0fc9\MigRegDB.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.26100.1_none_68cde88f2c470738\netiougc.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.26100.1591_none_d4511ac951bbf539\r\powershell_ise.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.26100.1591_none_efac539d4dc51fdd\r\PktMon.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_multimedia-windows-..n-playready-desktop_31bf3856ad364e35_10.0.26100.1150_none_d50cb16c6bb0fec5\r\prproc.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.26100.1591_none_5c83ef5441ff2734\r\WmsSvc.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.355_none_d6930f2587043445\vbc.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_10.0.26100.1_none_064f6097e94bbeed\powercfg.exe- 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_3878a6cb83aef2f593e7dd404f54089f_akira_amadey_elex_hijackloader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5608
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 2.3MB
- SHA256 689d93889b2469a43adf55be3abff3871768d0bc5a52f032c69a7e8a17d55936
- MD5 0fb29fd46ddbaff86d725094516630c9
- SHA1 e10be047f0a8a740d00e27d92a0ac6afc47e5b3c
- SHA512 e9620e1f635692fac0ab48006c9fe07a3b85821f3aa5be6d92d84af99665deb77419ed8186f2a8396afc53c9bff743becc531d8f464a9da795dd8498e5e13e81
- SSDEEP 24576:BLKfhIClyBZGFQn652EdCN0Le5ji0hmxNrMaa7/ezSC6vUyD/aqgrvWx6q8wyu6:BuyBZ92iPji0AjG/ezSC6vUzPvMHjyJ
- TLSH T123B52A16F6788732D072D1B9C5D3A65AFA3234465B308BCB034597383E277E68A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH