Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 03:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe
- Size 770KB
- Sample260423-ecbcksh19x
- SHA256 204f66738798d4bb3b578625ba592539bd1450e069baa9fec145a30b4ab4148e
- MD5 83fccb2dfb1f2ebe0a77b0de7a2d72b6
- SHA1 0c6865029c7c7286a68b4d95e06a55ce5d3c835b
- SHA512 efa968cd5460d5527c723895b50d26c881f06d2dee1a3f029a56cff2c116e2f8dd375be0661d0efee0e955950a34457f73177f1a6b5fa5d8190a4e297f5645f3
- SSDEEP 12288:fCTN4fGjLKf/ZIClyBOUFKJaGMsL2rn65hYgiOXtCL:KLLKfhIClyBZGFQn652EdCL
- TLSH T1B0F44A47F68D7BB9C4D9D238465FB222BE31BC480B22ABDB238466313D666D15F38354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (255) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 3 IoCs
pid Process 4948 Logo1_.exe 3092 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 2724 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX9768.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA499.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxOutlook.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\RCX978A.tmp Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164875\javaw.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\RCXA7A2.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe.Exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe File created C:\Windows\uninstall\rundl132.exe 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe File created C:\Windows\Logo1_.exe 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe 4948 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3408 wrote to memory of 4932 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 80 PID 4932 wrote to memory of 912 4932 net.exe 82 PID 3408 wrote to memory of 484 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 83 PID 3408 wrote to memory of 4948 3408 2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe 84 PID 4948 wrote to memory of 2752 4948 Logo1_.exe 86 PID 2752 wrote to memory of 4804 2752 net.exe 88 PID 484 wrote to memory of 3092 484 cmd.exe 89 PID 4948 wrote to memory of 2908 4948 Logo1_.exe 92 PID 2908 wrote to memory of 1324 2908 net.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:912
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F6.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe"3⤵
- Executes dropped EXE
PID:3092
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4804
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1324
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2724
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXA397.tmp
- Size 95KB
- SHA256 b86a0b99d3333c2c6b98e498d75534100d767f863cad694f455cf7d622887f2c
- MD5 4f50645428c2bde306cae5c6d0857fe8
- SHA1 6559f23262d8144944a0db80054ac37d6e890b2c
- SHA512 1829bb510c17f0792ebefaf8427fd007a7b0a4d3334a43fdbf5aef370f9f2b25d3c8c6b1ea67d185c03da954856b084881ac33f1f0df91377f60af8feb83b2a8
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxs8m3G5QGPMLfNz:oCSjGoLpWM6VbBgjxsxi3MbZ
- TLSH T12A933B5AB18CB376D0E155BC8E0FF6E5AD753E201E1D08AFB1A92F0DEDB61C1590C285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXA5D6.tmp
- Size 104KB
- SHA256 cb7875bb6b3634123cad905915e4e43956b52050429e55a81cbdbf6a0b099fe0
- MD5 ce5ef614c445cfba8efabae209ed0be3
- SHA1 5d2f94e712b9b2161748d252c3b0419915da130f
- SHA512 7de3dc3dbbb476a4adc4943b42b0ed6bdfebee97c66a90d75b4852637eaf337fb0185a595edbfd28c328f9c234bbcd14947ada60558a26d028b0159a10b1b4ff
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxl8m3G5QGPMLM1XkSPsULMHiJNg:ACSjGoLpWM6VbBgjxlxi3MAdtPlLqs+
- TLSH T179A36C69B28DF376C0E199BC8E0DF2E5BD257D300F19186BB19E2F0E9AB75C1590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXA6C8.tmp
- Size 91KB
- SHA256 f396591740014192661c164a65a9f0ceed159928854f5b92499391106139c96c
- MD5 59da3ca2d4772b6a6ae753a9443ec3fe
- SHA1 8a6d08def7b771f302ebaaaf0337d540979f37b5
- SHA512 41bf5c1bf94f668185a58048f3cc8620eb7b27a1b3a49f3a653adf8b94fcd2d7f1eb18428b2f6db9d7055f59825f6c6b59bf0a204be0e959d0a214d53a5546bf
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxf8m3G5QGPML4ND:wCSjGoLpWM6VbBgjxfxi3MUp
- TLSH T183935D69B28CB376D0F199B88E0DF2E5BD657E301F29086BB1AD2F0DDAB71C1590C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA4CA.tmp
- Size 119KB
- SHA256 21bffead22748b13ad61a33cdc6a8c0e6f91adb509d3918a733176ae3af18c7d
- MD5 50358cb0124772bad01c70b2550f1b35
- SHA1 d2ed93024bdb5d8ae97206021bda5e9bec96a1f4
- SHA512 e4778efa232d06410fa7682c36b0e9c64969456bc835e9d873f681040c0ecf003fce28a488018fda51789f7a669b997832efee35b059e9e09dd64667125fac9c
- SSDEEP 1536:U7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxv8m3G5QGPMLx4GZjzQwK5WW7VC/:NCSjGoLpWM6VbBgjxvxi3Mje5BV0PX
- TLSH T12EC3AE59B28CF377C0E159B88E0DF2E4BD797E201E29086FB5992F0DC9BB5C1590C692
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXA7C2.tmp
- Size 101KB
- SHA256 adef0c3cac4be2670a062ba4c0d306f76ed6b8e940f6f97f39ad80593a42537e
- MD5 93b021bfb30c2c7b56ad1ba0b9ffa053
- SHA1 2968c864173544ea2a6e2c9defd5102facad9483
- SHA512 37169b6c28b243d5391cdfd4df0cd7c5d40fc72a772b0bef9de08174017386d6ab6e919b867bab443cad58442304a2bc4cc4df94ed7e2d955f4947686d23b131
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxC8m3G5QGPMLeqkSZZZ3wNT:gCSjGoLpWM6VbBgjxCxi3M0Uw5
- TLSH T1F4A36C56B68CB3B2D0E189788E0DF3E5BD357D301F59182FB2AD3B0E9AB7182190C585
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 b98b356ad3a8ddbf953b3b12de229345879385f53745593ed2ccfd4081cc1105
- MD5 d9fb762b6a22362655c7476dd590a94c
- SHA1 37d8ee2138be915c3f4257f3078853a6f247d800
- SHA512 83dff2c78c9e5ea1f313f08ede1be2608869d1bd0716ef01c92c113712264b4dcb5d4bba5aab43bb9cba1aa9ada7e146d0d196d81cccc55e5d3dfdf62b04adbe
- SSDEEP 12288:fC2XZNYVLeyUji0h90ZD0wxpGZIVuKrHs:K60Le5ji0hmxNrM
- TLSH T193E40815F56CB331D0F2C0B9C9DEB68AED713C811B3089CB5286976C2E676E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCX9354.tmp
- Size 92KB
- SHA256 e4c55f8e6dda590b3f0e353d91bc21ddf9402d9bd59945c5beeb52953227c43b
- MD5 db5b15467d12c776d749e70203b229b3
- SHA1 42b91de440c54187bf431a1e6faa383242508696
- SHA512 368b9b9b2b617f501515f888bbb2e81beb430cfff9e75b579b730836262acdfed50336fe132f070cbcf0e5379e396e05fbc9de006f1ff1d4215e16ed5b956133
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxM8m3G5QGPMLUNL:wCSjGoLpWM6VbBgjxMxi3Mgx
- TLSH T17B935D59B28CB376D0F599B88E0DF2E5BD653E301F29086BB1AD2F0DDA771C1590C286
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX9492.tmp
- Size 93KB
- SHA256 3090f92883dcd9a77d0295b20dd0cd584622e24c55897a173b59bfdbb0d3c3d8
- MD5 8a0d5b6525eeb9b7938c886c8c7760dc
- SHA1 baa5d5dd363874328153b19f98cfb275c954ed3c
- SHA512 772201ec34e688abd65b16d5aa985917630e833e41e58aced153d78040347bb68054e9c7ec72a4b185221c800be324d0d8e48050c4bdb662fe9a1c16751c21e5
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxc8m3G5QGPMLpN7:YCSjGoLpWM6VbBgjxcxi3MNh
- TLSH T114935C5AB28CB376C0E559B88E0DF2E5BD793E301E29086BB1AE3F1DD9B71C1590C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe
- Size 4.3MB
- SHA256 9e363b6e2588773bc72e3ff546036b6e798459fddc6347edd8edb6b8c0d55003
- MD5 e70e0ff808eb007fff3e49a524c10bc0
- SHA1 5b4fea69d37ef34de4423ab6a7c0d968ea9d2ee0
- SHA512 d99818dc2bb3cc2e0869c39e9d20b19c0eea536450e743868d3b5df0260e6185c653b14d13c2eac1fa43edbf8e8ae61e2327792c9e40685218fc5da988a8c2de
- SSDEEP 49152:wgQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3Tf:xQvGAdlCEL8c/bRNw5CO
- TLSH T10B263A656BEC91F5E0E7D134897A95B2FB7A7C020D32EB4B0151CA2F2F336904D29729
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXAC39.tmp
- Size 93KB
- SHA256 da0feb2e81c63513eff9533643e2daabb194c6cbb330eec3dc82bb1d8103aa67
- MD5 62d4ecfb30ddbe024716dd57551a787b
- SHA1 23f97dd31dec3719a6a67114965dd635020ebd0f
- SHA512 70481b0312d44b2826fa9d3d90fe7dcee80dd38a2d211af54fb9995fe0150e8c512b6473bf85831b61e8f21c6e646e3a7a2e32a165a28466c1a62180685158b7
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjx08m3G5QGPMLCZNz:ACSjGoLpWM6VbBgjx0xi3MWZZ
- TLSH T1BA935C66F28CB376C0E199B88E0DF2E5BD397D305E29186BB1DD2F0D9AB71C1590C285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a5F6.bat
- Size 823B
- SHA256 80cf8bd600f12a868783a40763b41a5847cfa811b2cc00bab1bc5a7bbeb5a753
- MD5 9658eb44e8a260b1dff72130c801a088
- SHA1 40fa6510a1f08d771092129f31591d5aa3169216
- SHA512 ec591bbe4536bc5837ba6f79508f857aef2a94bf33050f6678545c4c0c5caf988a49268421f41541e565cdd2ad4a6824adf7f83cd49038413fbf306fdf634387
- TLSH T1F7012D0AC9AFF6DA052CF0679ABB5DCED463350D370A63165395C40E40D186EE4EA3E7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-23_83fccb2dfb1f2ebe0a77b0de7a2d72b6_akira_cobalt-strike_elex_hijackloader.exe.exe
- Size 677KB
- SHA256 fb6c0990e4976b9a98320e0912842ec11aa380a0f237affd35ef9ad2e7667905
- MD5 9ffa3c77f872dbb0e850b2b2bf7719b6
- SHA1 20a022077000802d8aae7abddde9f0da96f31249
- SHA512 90b7aee4ca245b9681f2aaf228379d42bd062b70955c302d9162ccb7b7acaaf5f9ac20f6fdf65d9b5084c55afbcefd8273e19f0af7d950928d1ba5f68fd454fa
- SSDEEP 12288:kN4fGjLKf/ZIClyBOUFKJaGMsL2rn65hYgiOXtCL:QLKfhIClyBZGFQn652EdCL
- TLSH T123E46C43FAC51EA9C45AD33846579322B731BC481B32EBDB1384A6313D667E16F39398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 0a110b7760ee6446461182a49fea68bd2c812886d931a8a05008a84a16be7021
- MD5 723e4e9aef882b6c7d1cf59ff8222268
- SHA1 93926f6886067220b47779a97ea5aed964bbfb97
- SHA512 f79a685d3a44189ff3992c25ac2608d1e0171b35166eb2b559f672620cab39ccbdb1d89b41657868672a40b873e61f5f5e0a5c01580f4ff2492a52ca0231f4c0
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjx88m3G5QGPMLWNa:4CSjGoLpWM6VbBgjx8xi3MSc
- TLSH T143935C59B29CB376C0E159B8CE0DF2E4BD697D701F2908ABB1AD3F1D9AB71C1090C685
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH