Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 02:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe
- Size 770KB
- Sample260423-ce5cbsf151
- SHA256 b7bcbfdafd2e49877a03062dbcc140414f9a8b8a2fac5b62c6407e52cd5fd1e9
- MD5 5b5f205afb7bb1fa8f52d2172d0242b7
- SHA1 170b144549e08a4660185ae903487c5d2a9009be
- SHA512 86ae9c609b543a666375c374c2bf5cde6a52685a36eb3b7a8f3df1720ca16cf1623a6a47c70ef33e9bd3592565b5a56e3cc9f66f2720cfd22f74c097c104290e
- SSDEEP 12288:qCyN4fGjLKf/ZIClyBOUFKJaGMsL2rn65hYgiOXtCL:v2LKfhIClyBZGFQn652EdCL
- TLSH T1DDF44A47F68D3BB9C4D9D238465FB222BE31BC481B22ABDB238466313D666D15F38354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (259) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 3 IoCs
pid Process 3252 Logo1_.exe 2908 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 2660 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.Exe Logo1_.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe.Exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zG.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\RCXB833.tmp Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe.Exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXB67F.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.Exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe.Exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXC4DB.tmp Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe File created C:\Windows\Logo1_.exe 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe 3252 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4784 wrote to memory of 1200 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 80 PID 1200 wrote to memory of 3000 1200 net.exe 82 PID 4784 wrote to memory of 3768 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 83 PID 4784 wrote to memory of 3252 4784 2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe 84 PID 3252 wrote to memory of 3444 3252 Logo1_.exe 86 PID 3768 wrote to memory of 2908 3768 cmd.exe 88 PID 3444 wrote to memory of 2236 3444 net.exe 89 PID 3252 wrote to memory of 1076 3252 Logo1_.exe 92 PID 1076 wrote to memory of 5004 1076 net.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:3000
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28A1.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe"3⤵
- Executes dropped EXE
PID:2908
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2236
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:5004
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2660
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXC2D7.tmp
- Size 94KB
- SHA256 d973892447ff7c0dbec4d954ae4d5b4edb08ca8c14041bc122a4e569b80d24d7
- MD5 c3324654ea84302f61e2cb9493b1be8b
- SHA1 3f7030fc2b4bd8c8d4e69e8c3a35d722ab9a5a16
- SHA512 a2aeb9fb9a6688eef2bb722a627c99ab3e9fbc4cb9336068ea869c32e1c3aa5cbad22c78e26079497d56092a593cb2993a87c9280e1224b2e1c1c95cac7bb939
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxN8m3G5QGPMLYNb:oCSjGoLpWM6VbBgjxNxi3McB
- TLSH T1DC933B5AB28DB376D0E199BC8E0FF2E5AD793E201E1D08AFB1992F0DDD761C1590C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXC45B.tmp
- Size 103KB
- SHA256 99acbfc06b88ba374da3ad16fd41849d082bca392cf6203cd7c5ca5150365f16
- MD5 4001cb0c8a594f143ecdf7c64cbf9195
- SHA1 f9dc775bcd6ed18772c2d9a2c24b94fcb3c9f289
- SHA512 63c7cbdd8e3e626b15eed133b2b9f97e9dcd5ef1e24e5dce7c464add1bbab1144e252333943c2245fcafdc40cbfe90ba920f9b6abc84ec1cae13f93ebc6cac56
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxM8m3G5QGPMLM1XkSPsULMHiuNI:wCSjGoLpWM6VbBgjxMxi3MAdtPlLqTG
- TLSH T170A37C1AB28DB376C0F199BC8E0DF2E4BD397E201F19186BB29D1F0D9A775C2590C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXC52D.tmp
- Size 90KB
- SHA256 99a7fbd734fc7c25877dbfb4926720126a00e25983792146519045fc23561ceb
- MD5 a7cd783e8587d4d9bbf9c9c221bf754f
- SHA1 8b70fde2b9ef3a4d0d5c709d5bac339039ca44dd
- SHA512 80fcc97a7f5ea9829c73df2ebcd28da1c0e0dd1be16ec6291d2413e3bc92bfc066f10cf378d8c3977fa5492ad60402d21f86b07143e42869c3a66a5b4b049d42
- SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxy8m3G5QGPML3Nr:QCSjGoLpWM6VbBgjxyxi3M7R
- TLSH T1BA934B6AB28DB376C0E299B88E0DF2E5BD797E301E29086FB19D1F0DDA771C1590C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXC3AA.tmp
- Size 118KB
- SHA256 fd35c503b574b9c83f6b64f42b8d1d396c2214645e243408153eaf542b5a12d0
- MD5 c1977ff3b898857cb54be7a6e4014528
- SHA1 f11e2b52a929da87372712ef2d0b8bce335cd985
- SHA512 c721d6867050c89cf410f300081f7093bc5b5196985fe054c1335e7220af8b2b8d5d68ec266cd5e2f2159cba6de0393585a689f2e198f1ed10996159cb7e6418
- SSDEEP 1536:A7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxy8m3G5QGPMLx4GZjzQwK5WW7VCs:RCSjGoLpWM6VbBgjxyxi3Mje5BV0ov
- TLSH T1A0C3AE69B28CB377C0E199B88E0DF2E5BD697E201F29085FB5992F0DCA7B5C1590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXC618.tmp
- Size 99KB
- SHA256 3120fd68735d2308ebbc5f1370c1df56a78307b5ea3231acf31678752c6b1c87
- MD5 6dca4dd8084c8ef9a003592fa96e0bac
- SHA1 aee7151e29c5fcc45ddae2f00774e2fe1c656ca3
- SHA512 9a69b9fe1d4bdb0d81ed26adc4d85cec8fa0082a89a2b92a36fd19bed6c9e38f93a6c88661dc9789e8c7eaae67ba5b4a88ca4299df0673e5f57a4371a58651f0
- SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxYk8m3G5QGPMLeqkSZZZ3vN7:QCSjGoLpWM6VbBgjxfxi3M0Uvh
- TLSH T15EA36B16B68CB3B6D0F189789E0DF3E5BD357E300F69185BB2AD3B0D9A77182590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 2478e740e5169ded7070cf48ae89f5e07d40ac89512c9115d51bbe72319ce51d
- MD5 db5bc5b3ac92b0ffeccfc9ed566de011
- SHA1 9c50632319fc25a186215450ccc913cd1262e0c7
- SHA512 eca7d6d74d385ec3278e7316e597e3c85b17bdfaaa76fa94acc495750ca197e7c35db5413cf3a99aba62082c0b6db214f6d1329f2cb3d78bb916974001ed118e
- SSDEEP 12288:qChXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:vn0Le5ji0hmxNrM
- TLSH T125E40716F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286976C6E276E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCXB5EF.tmp
- Size 91KB
- SHA256 a08507b5117ece5d6246f159425bf52fbb16029d1c433f0a5b7e8ed1162427e8
- MD5 7b4e6edd2c1edf8712f2dbed263cfc61
- SHA1 45a2d48bf85a512d686f5b82e53be9c40a360347
- SHA512 b296bc5ee817806151951d06e9dd4a650316139e57f549a31d5e2b90caf2afca620d081e492801336982085b7e083ee7502112dacfcd9075f5e3e98b1f0d9491
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxF8m3G5QGPML7NT:ACSjGoLpWM6VbBgjxFxi3M/5
- TLSH T16F935C5AB28DB376D0E199B88E0DF2E5BD797E301F19086FB1AD2F0D9A771C1590C182
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\RCXB8E6.tmp
- Size 156KB
- SHA256 3f26006c844619309738037744ea855ba0b8941de800add3a803716cc8aac709
- MD5 147800be2cafcba5ba06bd3d00977977
- SHA1 573d24d28b306fd2db60482ca8f3b90d438255ef
- SHA512 9bdf22637a929a2fb0b87712d529be0563f03550f8ffd3db8bbdb1475c9100aad90cfe2131aee029e0a3b27d3af2650b2fe52b3d22aa3616b8d2fe9142c4b830
- SSDEEP 1536:I7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxm8m3G5QGPMLPncNL:ZCSjGoLpWM6VbBgjxmxi3M7cx
- TLSH T1BFF3C476B25CB776D0E199B84E1DF1E0AC6D3E201E2BCC6A715A3F0DBB761C11A0858D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXB8B5.tmp
- Size 91KB
- SHA256 135197806012b263bbc820fc372552821be3974bf89a96a628a49aad4e3ec3cb
- MD5 28b4c7d24903ca5d6326beff169702a9
- SHA1 9859ed7608c64be934ef09137cf1975ea1e971d9
- SHA512 fa3c91f98c7fda4b1f67afad171037e6945307d4a9c1a439cd2190465280e079e7eee0c2520698119f533cfeb957968dace7311551de1d4f7b44428dcf287675
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxt8m3G5QGPMLRND:YCSjGoLpWM6VbBgjxtxi3M1p
- TLSH T1C2934B55B29CB376C0E299B8CE0DF2E5BD697E700F2908ABB1AD3F1D9A771C1590C181
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCXCA5E.tmp
- Size 91KB
- SHA256 fbc83795f63d9ffa1cd75e5e51f738f04aa2610320a0f0fbe52daa80c91baa53
- MD5 5bf805528a8a1156503bd2ae95f9ed19
- SHA1 1462a34ce87eb98eb7340b772720ea27e7d93457
- SHA512 35c7ebceb3fa8e6d9d181b7b1460f65620b03bd6e7eddf60d1eee1ced8a6bc8cfe944b52359e55e683e194e27e7706acbf261e9511314ac3243d4b0f8d5bcf9e
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxf8m3G5QGPMLmNj:oCSjGoLpWM6VbBgjxfxi3MCJ
- TLSH T110935C6AB28DB376C0E199B88E0DF2E4BD797E300E29186BB19D1F0DDE775C2590C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXCA9E.tmp
- Size 92KB
- SHA256 cfe37620f14fafad6e45fc5a76e8ad11b3741f33bc4f5b583ae80ea52e211cb6
- MD5 71936666602953cbb1d778922a0527be
- SHA1 21c5eb05877fdfb26f82f1007b03fa161bbc181b
- SHA512 ecf6aed3502c0f119fcfb760f4e503187da6665096adea464e0f54c58b87d46d9a6e36436a1e2e36ef5e3ea353701d78e54be983f31c67930f86524c980bc9c0
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjx18m3G5QGPMLCeNb:gCSjGoLpWM6VbBgjx1xi3MWeB
- TLSH T1E9935C2AF28DB376C0E199B88E0DF2E5BD797D305E29186FB29D2F0D9A771C1490C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a28A1.bat
- Size 824B
- SHA256 8596e79e13a859896deb5eab3f4bb0a61f5778c6cc2c0a7b2ff23892c3dd2e06
- MD5 1680e7aca57976634e55beb68740bf61
- SHA1 f4697c12f82bd38febb20f219970235296f8bafb
- SHA512 a2d6442d5ae6a14fc28b6f7b40404a243169d84a22eb501e27159f36112f9844989cf3ac2a359ff7aef3c1aa5ecc7cce676bb8ff771b8cb5377d4087d13d946a
- TLSH T10D01E509C0BED5EE012CA25BD664DDCF82617F5C271F23464390C01D5BE294AA6F1B83
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-23_5b5f205afb7bb1fa8f52d2172d0242b7_akira_cobalt-strike_elex_hijackloader.exe.exe
- Size 677KB
- SHA256 fb6c0990e4976b9a98320e0912842ec11aa380a0f237affd35ef9ad2e7667905
- MD5 9ffa3c77f872dbb0e850b2b2bf7719b6
- SHA1 20a022077000802d8aae7abddde9f0da96f31249
- SHA512 90b7aee4ca245b9681f2aaf228379d42bd062b70955c302d9162ccb7b7acaaf5f9ac20f6fdf65d9b5084c55afbcefd8273e19f0af7d950928d1ba5f68fd454fa
- SSDEEP 12288:kN4fGjLKf/ZIClyBOUFKJaGMsL2rn65hYgiOXtCL:QLKfhIClyBZGFQn652EdCL
- TLSH T123E46C43FAC51EA9C45AD33846579322B731BC481B32EBDB1384A6313D667E16F39398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 0bd95b32e6e53dc756d999adb192aae26e05d45a707d8774e5f38660be629a3f
- MD5 79eb5abc79bba14912bf1dcb5dd3348f
- SHA1 949e4430016e0ab42a7bb558dc300c2186487df9
- SHA512 9233c1ad299a611e1ac8a1d51121ca2aaaed931985fc901aef2c53043b6564386ce47d824d44ab22ec5e2cc8510076fd3d4cc577dc9ea611dcfe93abbbe64267
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxt8m3G5QGPMLONTB:wCSjGoLpWM6VbBgjxtxi3MKb
- TLSH T112935C56B29CB376C0F199B88E0DF2E5BD257E301F19086BB1AE3F1D9A771C1590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH