Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 05:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe
- Size 770KB
- Sample260711-gp6qcsey21
- SHA256 73ca46594ffdafa9cc8fe8640bb27db5711924690339480cd9849cf933dabca1
- MD5 6757d3cbf6c14d6b54ba75d602424d49
- SHA1 5b4f5453bfade1382d74c6837d2726af17e60989
- SHA512 7a7f452f218fbf6642abe73c7262aa17a1a5a3f9433e11be0027f053bf118a3e87dc11129515b90b9a197d87f66b96ac9e24a822bb30f6582e7c4917a384f8e3
- SSDEEP 12288:VCSN4fGjLKf/ZIClyBOUFKJaGMsL2rn65hYgiOXtCL:gWLKfhIClyBZGFQn652EdCL
- TLSH T10DF44A47F68D7BB9C4D9D238465FB222BE31BC480B22ABDB238466313D666D15F38354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 3 IoCs
pid Process 1412 Logo1_.exe 3948 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 4636 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\RCXAA21.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\RCXAB85.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe.Exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX9E78.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe Logo1_.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.Exe Logo1_.exe File created C:\Program Files\7-Zip\7z.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RCX9D65.tmp Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA811.tmp Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.Exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe File created C:\Windows\Logo1_.exe 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe 1412 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3500 wrote to memory of 2624 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 88 PID 2624 wrote to memory of 3360 2624 net.exe 90 PID 3500 wrote to memory of 6116 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 91 PID 3500 wrote to memory of 1412 3500 2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe 92 PID 1412 wrote to memory of 3908 1412 Logo1_.exe 94 PID 3908 wrote to memory of 4368 3908 net.exe 96 PID 6116 wrote to memory of 3948 6116 cmd.exe 97 PID 1412 wrote to memory of 1036 1412 Logo1_.exe 100 PID 1036 wrote to memory of 4612 1036 net.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:3360
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9F.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe"3⤵
- Executes dropped EXE
PID:3948
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4368
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4612
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4636
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXA3CE.tmp
- Size 157KB
- SHA256 ea7df7904b506e7832bc64c6b23aed4a2742cf140474d3b529c3a3475fe9caea
- MD5 b02e89886a4edfd46df26b002fd899b4
- SHA1 950b1a043257459f25a08fe407c973015b4b4ed1
- SHA512 a64381d3d0bd41473ecc603079c585f283b0ee569d6c58b5aa7a00bc9789447358aff90268cce1323bc8cbcb844ca5f43a3d5f7d4cdc34abe994e5fbc806d2af
- SSDEEP 1536:s7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjx98m3G5QGPMLtNj:lCSjGoLpWM6VbBgjx9xi3MJJ
- TLSH T1B0F3B36DA14FB3F6C3E1997C8D1CF2A5ED29FE20CE19285B75993B0E9A760C34508191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXA6ED.tmp
- Size 94KB
- SHA256 60428751ef5d2c5306bb6debdce2f0ac47b7a618e0140e808648581a75a91d5e
- MD5 542bd3308c2f1acd0350163feb4abb54
- SHA1 6b61c362927eaefa861d00c4fdd17a63274e0e54
- SHA512 0299244149a352a0da824aa09203f4aefc17eb3b8aa974f5577c595454ff2068599682f0b684d67d36bf05949d6699feb08fcd9a41b04db17e9dd444663b20a0
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxC8m3G5QGPMLuNz:4CSjGoLpWM6VbBgjxCxi3MyZ
- TLSH T12A932A5AB28CB3B6C0E299BC8E0FF2E5AD757E201E1D189FB1992F0DDD761C1590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXA98F.tmp
- Size 103KB
- SHA256 2df8a5116b25bb581114281f1fb76537cca2e460bb9a8879a3027dcd7858a1e3
- MD5 b480ef7f47e2839d40d6ac6059c140f3
- SHA1 5dc723664a047e6223a16b19546b24357efc6af0
- SHA512 841a618df632404dd075292d772de2485d2089d2268b34c034ee9236832e4a6911d6c65de358ad3279790bd04da443bd7b423f00a75e78fed3feb525279e1b6e
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxf8m3G5QGPMLM1XkSPsULMHiUNg:ACSjGoLpWM6VbBgjxfxi3MAdtPlLqp+
- TLSH T150A37C69B68DB3B6C0E299BC8E0DF2E5BC357D300F19186BB19D2F0D9A775C2590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXA9E0.tmp
- Size 91KB
- SHA256 d7b9224e5ec685a9fb58ad76226bfcd9dd8327dc0aea11746b1e13627102ea4b
- MD5 2cbcc0b42fba38563102af0e77ffdb65
- SHA1 3ba9450dfca2f677dfa11f5b69951413b1bf17e7
- SHA512 fad838ed60b7841df9d8759f7fdecd45d7e809ba6303beea99d3fdd73605d0e9ee7191330694c650547f43df4f54f1fbec7a442ceb44ec946b885fb6e5e0dbe2
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxN8m3G5QGPMLNND:YCSjGoLpWM6VbBgjxNxi3MRp
- TLSH T1D8935C69B68CB3B6C0E299B88E0DF2E5BD757E300F19185BB19D2F0DDA771C2590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA811.tmp
- Size 119KB
- SHA256 78af3633facd1b0fdcc4d24ca358c44d85b093ac7aa38e1c7105ea03523ca4e5
- MD5 b1ba6f5b7df709b8b6a5881a2d713796
- SHA1 a0e5b91e9afa7fb09ad7839c00c9e7c7f53be3f8
- SHA512 277dd944e2c0b853bd7ab692683279e768d1fef1c51a61767a63c33c1370a3eb3070934dc49d4e49c4ac23a5fbf474cab80c83701c3c8888c76f812d9772b9a7
- SSDEEP 1536:Q7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjx98m3G5QGPMLx4GZjzQwK5WW7VCW:BCSjGoLpWM6VbBgjx9xi3Mje5BV0+X
- TLSH T1DCC3AE69B68CB3B7C0E299B88E0DF2E5BD797E301E19085FB5992F0DC97B1C1590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXABB5.tmp
- Size 100KB
- SHA256 e7fd875fb768f95d8c447fd898404ddfdb190ca3dfffe239ac88034b92c64cfd
- MD5 d0c8a6e538c7147d01867a02b65adbd7
- SHA1 7950ec6ece62aedffb27298891324e02a9d34829
- SHA512 55c5d2361c390fa79b5549edac063b9f96fbf382235c7f28567530c627746ba4baf4635e079568c21ec17d5a7839a7380a16668256e342897458fb0cc127c33a
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxc8m3G5QGPMLeqkSZZZ3lNT:ACSjGoLpWM6VbBgjxcxi3M0Ul5
- TLSH T1DDA36C5AB68CB3B6D0E289789E1DF3E1BD397D301F59182FB29D3B0D9A77182150C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX9AE8.tmp
- Size 92KB
- SHA256 3889d6cf0af208d1232ba388d7bd5023dcf58b2fb8c30b1ad870de38d65e294a
- MD5 3065121670cb8081389af797b80ec00b
- SHA1 62557a075674d6286d8e403204a268840cc61cd8
- SHA512 b95af99c2ffe2c29478bbd0006ba940282a9881c3d20e500cdc826056f8f60ab76c54d9687bee8be343f381d0f11b069bcfed8e43f54001841aa3b1b030fea21
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxi8m3G5QGPML0N7:4CSjGoLpWM6VbBgjxixi3Mgh
- TLSH T112935C69B68CB376C0E299B88E0DF2E5BD397D301E19186FB1AD3F1D99771C2490C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCX9E57.tmp
- Size 92KB
- SHA256 a2199de72c2c99f3b91d9479daa865ff89cf1fa362d0de67deba12110d26d126
- MD5 c42f08129ca71434eea4df554c19ec35
- SHA1 e94b03f2a48655aa61cbcdecfcbc3fbdb1b5f5fd
- SHA512 912c562ad364b6e20d013e9effde792ac53d7a29470d33e7a69f776d2357668b96debbd650d8e41c85a1d5bf908f50cd715b08dab4a42e6bd18fd3d0ce903b66
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjx68m3G5QGPMLHN7:wCSjGoLpWM6VbBgjx6xi3Mbh
- TLSH T1A0934C59B68CB376C0E2A9B88E0DF2E5BD397E300F19185BB19D2F1D997B1C2590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXB04B.tmp
- Size 93KB
- SHA256 33467aa661a9db18610e54b08b3670cac3b31e66a48babb763b4652d65b510bb
- MD5 8aa24d1a3f4fc589a65fd51955751127
- SHA1 8201a709bfb8bd424d6c18e847dcf7b98ee7967c
- SHA512 88d68eabce44f408576b2a200920a026e4d34d21816ae95aee875ea0e9f471f9d695cc5d81373e63b074187b10b29f0a77e0ae0aa9432fdd4acd09688d26b28e
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxi8m3G5QGPMLCENz:YCSjGoLpWM6VbBgjxixi3MWEZ
- TLSH T1C6935C66F68CB3B6C0E299B88E0DF2E5BD397D304E29186B719D2F0D9E771C2550C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$aB9F.bat
- Size 823B
- SHA256 b8ff8b1c6cf83fe8673f0854d24e980ae6ee72cbaa72bd4a477ba20d5ed04ab5
- MD5 4ad7392531ae5d63ba6e0c46c7a83740
- SHA1 1637e5f954863b5b215de102f43499a57a09c485
- SHA512 d8d7d90b07499c465f0f3d0a3ea613606e57b89bc7bfdc39af800e3950faa2b26a11581fe9b1788ec01b9925b0f264e3a00f10388777214103475b76435977e8
- TLSH T1F301A501907FDA9D4524F0A7CA31BE8DE06AA99E3B6E770507B4870C51E280FECE57C6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-07-11_6757d3cbf6c14d6b54ba75d602424d49_akira_cobalt-strike_elex_hijackloader.exe.exe
- Size 677KB
- SHA256 fb6c0990e4976b9a98320e0912842ec11aa380a0f237affd35ef9ad2e7667905
- MD5 9ffa3c77f872dbb0e850b2b2bf7719b6
- SHA1 20a022077000802d8aae7abddde9f0da96f31249
- SHA512 90b7aee4ca245b9681f2aaf228379d42bd062b70955c302d9162ccb7b7acaaf5f9ac20f6fdf65d9b5084c55afbcefd8273e19f0af7d950928d1ba5f68fd454fa
- SSDEEP 12288:kN4fGjLKf/ZIClyBOUFKJaGMsL2rn65hYgiOXtCL:QLKfhIClyBZGFQn652EdCL
- TLSH T123E46C43FAC51EA9C45AD33846579322B731BC481B32EBDB1384A6313D667E16F39398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 1fd1aa0395dcc95d061512cf5b6eda3480ac93582504c70bf8c9b18d858d2052
- MD5 7a042062c6ff67d787f9c3ca707cd264
- SHA1 ba79a1f45c2f8ef314f32118c18066c1fd3cdc92
- SHA512 ae80c775501b212f6b6723f7cf9b3a8cd612d44fc92b485369c0e0adfda8a1140b80663cff7cf25ab8814af264b2030acef7553a5a4d7d358179339d9c0e6e88
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxa8m3G5QGPMLwNf:wCSjGoLpWM6VbBgjxaxi3MU1
- TLSH T18B934C69B68CB3B7C0E299B88E0DF2E5BD797E300F19185BB19D2F1D9A771C1590C182
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH