Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/07/2026, 05:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe
- Size 770KB
- Sample260711-gp6qcsey21
- SHA256 73ca46594ffdafa9cc8fe8640bb27db5711924690339480cd9849cf933dabca1
- MD5 6757d3cbf6c14d6b54ba75d602424d49
- SHA1 5b4f5453bfade1382d74c6837d2726af17e60989
- SHA512 7a7f452f218fbf6642abe73c7262aa17a1a5a3f9433e11be0027f053bf118a3e87dc11129515b90b9a197d87f66b96ac9e24a822bb30f6582e7c4917a384f8e3
- SSDEEP 12288:VCSN4fGjLKf/ZIClyBOUFKJaGMsL2rn65hYgiOXtCL:gWLKfhIClyBZGFQn652EdCL
- TLSH T10DF44A47F68D7BB9C4D9D238465FB222BE31BC480B22ABDB238466313D666D15F38354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 3 IoCs
pid Process 3496 Logo1_.exe 832 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 4160 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX91.tmp Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RCX12E1.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\RCX1369.tmp Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX351.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe.Exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zG.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX2FF.tmp Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXFE28.tmp Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe File created C:\Windows\uninstall\rundl132.exe 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe 3496 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1808 wrote to memory of 4804 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 83 PID 4804 wrote to memory of 3508 4804 net.exe 85 PID 1808 wrote to memory of 4460 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 87 PID 1808 wrote to memory of 3496 1808 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 88 PID 3496 wrote to memory of 4716 3496 Logo1_.exe 90 PID 4460 wrote to memory of 832 4460 cmd.exe 93 PID 4716 wrote to memory of 4684 4716 net.exe 94 PID 3496 wrote to memory of 3544 3496 Logo1_.exe 101 PID 3544 wrote to memory of 1316 3544 net.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:3508
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6ED2.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe"3⤵
- Executes dropped EXE
PID:832
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4684
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1316
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4160
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXF41.tmp
- Size 94KB
- SHA256 60428751ef5d2c5306bb6debdce2f0ac47b7a618e0140e808648581a75a91d5e
- MD5 542bd3308c2f1acd0350163feb4abb54
- SHA1 6b61c362927eaefa861d00c4fdd17a63274e0e54
- SHA512 0299244149a352a0da824aa09203f4aefc17eb3b8aa974f5577c595454ff2068599682f0b684d67d36bf05949d6699feb08fcd9a41b04db17e9dd444663b20a0
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxC8m3G5QGPMLuNz:4CSjGoLpWM6VbBgjxCxi3MyZ
- TLSH T12A932A5AB28CB3B6C0E299BC8E0FF2E5AD757E201E1D189FB1992F0DDD761C1590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCX127F.tmp
- Size 103KB
- SHA256 2df8a5116b25bb581114281f1fb76537cca2e460bb9a8879a3027dcd7858a1e3
- MD5 b480ef7f47e2839d40d6ac6059c140f3
- SHA1 5dc723664a047e6223a16b19546b24357efc6af0
- SHA512 841a618df632404dd075292d772de2485d2089d2268b34c034ee9236832e4a6911d6c65de358ad3279790bd04da443bd7b423f00a75e78fed3feb525279e1b6e
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxf8m3G5QGPMLM1XkSPsULMHiUNg:ACSjGoLpWM6VbBgjxfxi3MAdtPlLqp+
- TLSH T150A37C69B68DB3B6C0E299BC8E0DF2E5BC357D300F19186BB19D2F0D9A775C2590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCX12D0.tmp
- Size 91KB
- SHA256 d7b9224e5ec685a9fb58ad76226bfcd9dd8327dc0aea11746b1e13627102ea4b
- MD5 2cbcc0b42fba38563102af0e77ffdb65
- SHA1 3ba9450dfca2f677dfa11f5b69951413b1bf17e7
- SHA512 fad838ed60b7841df9d8759f7fdecd45d7e809ba6303beea99d3fdd73605d0e9ee7191330694c650547f43df4f54f1fbec7a442ceb44ec946b885fb6e5e0dbe2
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxN8m3G5QGPMLNND:YCSjGoLpWM6VbBgjxNxi3MRp
- TLSH T1D8935C69B68CB3B6C0E299B88E0DF2E5BD757E300F19185BB19D2F0DDA771C2590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX1110.tmp
- Size 119KB
- SHA256 78af3633facd1b0fdcc4d24ca358c44d85b093ac7aa38e1c7105ea03523ca4e5
- MD5 b1ba6f5b7df709b8b6a5881a2d713796
- SHA1 a0e5b91e9afa7fb09ad7839c00c9e7c7f53be3f8
- SHA512 277dd944e2c0b853bd7ab692683279e768d1fef1c51a61767a63c33c1370a3eb3070934dc49d4e49c4ac23a5fbf474cab80c83701c3c8888c76f812d9772b9a7
- SSDEEP 1536:Q7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjx98m3G5QGPMLx4GZjzQwK5WW7VCW:BCSjGoLpWM6VbBgjx9xi3Mje5BV0+X
- TLSH T1DCC3AE69B68CB3B7C0E299B88E0DF2E5BD797E301E19085FB5992F0DC97B1C1590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 8d15c4f63299982ced35044ebe537420d40a24469b3b66115075affd64658bd6
- MD5 c538b53132c6a86bb88ea485e477f80c
- SHA1 6b0ae5f115b91360ce6729b82ef0d83ace336591
- SHA512 e9e8bd68548b0dcb75c3dbf21922cdce8ce84ecf880690c62868e12176b4f7c2a8c790d54a8b81273e8a6fe3b8a72578024b6d8dbbfb2f7757d5682957dd7cb0
- SSDEEP 12288:VCBXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:gH0Le5ji0hmxNrM
- TLSH T123E40715F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286876C6E676E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXFF44.tmp
- Size 92KB
- SHA256 3889d6cf0af208d1232ba388d7bd5023dcf58b2fb8c30b1ad870de38d65e294a
- MD5 3065121670cb8081389af797b80ec00b
- SHA1 62557a075674d6286d8e403204a268840cc61cd8
- SHA512 b95af99c2ffe2c29478bbd0006ba940282a9881c3d20e500cdc826056f8f60ab76c54d9687bee8be343f381d0f11b069bcfed8e43f54001841aa3b1b030fea21
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxi8m3G5QGPML0N7:4CSjGoLpWM6VbBgjxixi3Mgh
- TLSH T112935C69B68CB376C0E299B88E0DF2E5BD397D301E19186FB1AD3F1D99771C2490C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\RCX2C0.tmp
- Size 157KB
- SHA256 98b2e2bd991c6ba08ec395c8e9e01d8833b1aaa28ea30cf8da305b490b9d636d
- MD5 0d9302a54d2771cc6b38cf0740df2f14
- SHA1 3473c7f51adb3cbd4de131a84a28133510f7d4cd
- SHA512 0e6048c65826e219cae45d0166e2750e391ee6cb4b0570a08207ce3e822dade4d9f0ea2e2b1a66ad7c2e1a5ab97545b735ffb709e88d75d19bd5a9c58981355c
- SSDEEP 1536:s7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjx98m3G5QGPMLPnyNj:lCSjGoLpWM6VbBgjx9xi3M7yJ
- TLSH T1B9F3D476B25CB776D0E199B88E1CF1E0AC6D7E201E2BCC6A71593F0DBB761C11A0858D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX27F.tmp
- Size 92KB
- SHA256 450a98c4f3b7f6f3e69c3f9fd811fd4d416d4268d91ee99d9b54f7a020255010
- MD5 1de128b6baaf975070ded3e5e95c9bb3
- SHA1 ced4434e0d0d736950af184f3e865e79579aaa4c
- SHA512 034d9f5ddac8714ed2d563887c0b0c169fb5f7825fb387e527520ce3a6b852f26897b2774f1c29f214729739f5b709db5408c0ffe3bd4cf7f8d05eb87f76d9b1
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjx68m3G5QGPMLHN7:wCSjGoLpWM6VbBgjx6xi3M7h
- TLSH T1D2934C59B68DB376C0E299B8CE0DF2E5BD397D700E1918AFB1AD3F1D9A761C1490C182
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\RCX351.tmp
- Size 100KB
- SHA256 e7fd875fb768f95d8c447fd898404ddfdb190ca3dfffe239ac88034b92c64cfd
- MD5 d0c8a6e538c7147d01867a02b65adbd7
- SHA1 7950ec6ece62aedffb27298891324e02a9d34829
- SHA512 55c5d2361c390fa79b5549edac063b9f96fbf382235c7f28567530c627746ba4baf4635e079568c21ec17d5a7839a7380a16668256e342897458fb0cc127c33a
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxc8m3G5QGPMLeqkSZZZ3lNT:ACSjGoLpWM6VbBgjxcxi3M0Ul5
- TLSH T1DDA36C5AB68CB3B6D0E289789E1DF3E1BD397D301F59182FB29D3B0D9A77182150C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCX1801.tmp
- Size 92KB
- SHA256 1a26b393e3141b9c6f65d1babc6fcae47e1b0ec86e66d66d022784679daf2b7b
- MD5 2c703c95e2dcee08b3599442d42b6a7b
- SHA1 12a21c21c5bff75c0b21fce18853610f1e6ddf75
- SHA512 53fab4951a5155f643016f6654d8ae2e7068ae7fb540f8107ff387d2ce85caa49c77725ea50d779d1a32e3441a12d80faec3cbc8f43f6321ddebe14369fc95d7
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxc8m3G5QGPMLMNb:gCSjGoLpWM6VbBgjxcxi3MYB
- TLSH T16F935C69F68DB3B6C0E299B88E0DF1E5BD397D301E19186FB19D2F0D9A771C2490C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCX1870.tmp
- Size 93KB
- SHA256 33467aa661a9db18610e54b08b3670cac3b31e66a48babb763b4652d65b510bb
- MD5 8aa24d1a3f4fc589a65fd51955751127
- SHA1 8201a709bfb8bd424d6c18e847dcf7b98ee7967c
- SHA512 88d68eabce44f408576b2a200920a026e4d34d21816ae95aee875ea0e9f471f9d695cc5d81373e63b074187b10b29f0a77e0ae0aa9432fdd4acd09688d26b28e
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxi8m3G5QGPMLCENz:YCSjGoLpWM6VbBgjxixi3MWEZ
- TLSH T1C6935C66F68CB3B6C0E299B88E0DF2E5BD397D304E29186B719D2F0D9E771C2550C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a6ED2.bat
- Size 824B
- SHA256 6cd6e07b8c317f1d4df59f71b8c93376bb53739681c2aa9b4224fa12836808aa
- MD5 8b0e29ee41b9f932a48cb9e3d0c7427f
- SHA1 a9f036a4826af8754f03a7f303a1fb1d830221e7
- SHA512 5af7f5dbf41b8fb3f042b35aa045c8c7db7185d96f927896ecf880c0bae4015ac48f239ad53ed2f8dc5b73c3da00b0163f237d81a4669a2ec7e2fe3b27611dcd
- TLSH T1A501A501907FDA9D4524F0A7CA31BE8DE05AA99E3B6E770507B4870C51E280FECE57C6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe.exe
- Size 677KB
- SHA256 fb6c0990e4976b9a98320e0912842ec11aa380a0f237affd35ef9ad2e7667905
- MD5 9ffa3c77f872dbb0e850b2b2bf7719b6
- SHA1 20a022077000802d8aae7abddde9f0da96f31249
- SHA512 90b7aee4ca245b9681f2aaf228379d42bd062b70955c302d9162ccb7b7acaaf5f9ac20f6fdf65d9b5084c55afbcefd8273e19f0af7d950928d1ba5f68fd454fa
- SSDEEP 12288:kN4fGjLKf/ZIClyBOUFKJaGMsL2rn65hYgiOXtCL:QLKfhIClyBZGFQn652EdCL
- TLSH T123E46C43FAC51EA9C45AD33846579322B731BC481B32EBDB1384A6313D667E16F39398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 1fd1aa0395dcc95d061512cf5b6eda3480ac93582504c70bf8c9b18d858d2052
- MD5 7a042062c6ff67d787f9c3ca707cd264
- SHA1 ba79a1f45c2f8ef314f32118c18066c1fd3cdc92
- SHA512 ae80c775501b212f6b6723f7cf9b3a8cd612d44fc92b485369c0e0adfda8a1140b80663cff7cf25ab8814af264b2030acef7553a5a4d7d358179339d9c0e6e88
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxa8m3G5QGPMLwNf:wCSjGoLpWM6VbBgjxaxi3MU1
- TLSH T18B934C69B68CB3B7C0E299B88E0DF2E5BD797E300F19185BB19D2F1D9A771C1590C182
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH