Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 08:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe
- Size 770KB
- Sample260712-kwtk6ae17q
- SHA256 3eb79a7b2a77c14ac1f00eb84c38909789473bec1a383854b684293a8160a90f
- MD5 8ecb403cff74d7b8e8305aa0fd6daa4f
- SHA1 8a4f0a11631fda5d2e5f2929ab32a4748536573f
- SHA512 158e78b4f29f6c2cbb1342858516aaeb37a0afdcdd96d487c93974e850642a72a1b244b7fa96d42bc31dcbc3937364dedec1628c542198168c12c43275b45478
- SSDEEP 12288:eN4fGjLKf/ZIClyBOUFKJaGMsL2rn65hYgiOXtCL:yLKfhIClyBZGFQn652EdCL
- TLSH T10EF44A47F68D7BB9C4D9D238465FB222BE31BC480B22ABDB138466313D666D15F38358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 3 IoCs
pid Process 5368 Logo1_.exe 4548 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 2952 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXC642.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe Logo1_.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe Logo1_.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe.Exe Logo1_.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\RCXD42F.tmp Logo1_.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Defender\MpCmdRun.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RCXC782.tmp Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXC543.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXD39B.tmp Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.Exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe File created C:\Windows\Logo1_.exe 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe 5368 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1352 wrote to memory of 5688 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 87 PID 5688 wrote to memory of 3340 5688 net.exe 89 PID 1352 wrote to memory of 3836 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 90 PID 1352 wrote to memory of 5368 1352 2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe 92 PID 5368 wrote to memory of 4088 5368 Logo1_.exe 93 PID 4088 wrote to memory of 2664 4088 net.exe 95 PID 3836 wrote to memory of 4548 3836 cmd.exe 96 PID 5368 wrote to memory of 5776 5368 Logo1_.exe 99 PID 5776 wrote to memory of 3040 5776 net.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:3340
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a360A.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe"3⤵
- Executes dropped EXE
PID:4548
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2664
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3040
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2952
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXCE39.tmp
- Size 156KB
- SHA256 807de63f949c7a42263e6781bdb5686013498377d7c793a33f45a3866db9125a
- MD5 0ca2a339177fab12c7fc42345a589f91
- SHA1 a659241e3458b7387173387a1bf7f937704b4131
- SHA512 61bb2fc5e9490d12ad89bf5c73b9bf234a23b434115506e995c72f3a7369e10fa3394828cd66bc9d569eaf3409316aef525f62dbd41014fb9c2129003a39a293
- SSDEEP 1536:c7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t64Nm:1CSjGoLpWM6VsBEjxQZdRE
- TLSH T1FBF3B36EB18FB3F6D3E159BC8D1CF295ED28FE20CE19285A75993B0EDA760C34508191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXD0AD.tmp
- Size 94KB
- SHA256 a59eca29b90378fb12031308e380e1a313ec65e22a6061d044ac80816490e077
- MD5 8c7b2c3e6842c50b0c7f1cbf0d6eed06
- SHA1 0cd83ecb0e4d62f738617fdfba49587931b33736
- SHA512 9af9a0cfad3cfe7339c8578db54ab2c5f7e5681f157eb1a49d2d2c212c8ba2e3efb74a3868dd4ce104cf0f2d2307ddf139076ac1df7350bb4527723ff5bff876
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx/8SXzpn9t63NW:4CSjGoLpWM6VsBEjx/Zd60
- TLSH T10893295AB18DB372D0E259BC8E0FF2E5BD397E201E1D189FB6992B0DDE760C1190C295
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXD3AC.tmp
- Size 103KB
- SHA256 99b606d01c566ec45baa50df48c554ce7d1b6b4cc49c739a6e5c3115ae0c879b
- MD5 b3cf440cb0c5488d38353292a17ce988
- SHA1 fc20e5d71b04892bcf14bceba6ccad29690dbd38
- SHA512 d059fdebb8f285fe82a675f340efa8fd0a9d328a730b44b68a811d976e73aa45624082eccc15ff2962f82519fc1ae8cec321a453b0cad1987334e5711b72555b
- SSDEEP 1536:h7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx68SXzpn9t6M1XkSPsULMHiZNr:ICSjGoLpWM6VsBEjx6ZdddtPlLqER
- TLSH T115A37C69B28DB372D0E299BC8E0DF2E5BD397E300F1A185FB59E1F0D9A765C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXD40D.tmp
- Size 90KB
- SHA256 5afa0245aa83b58c27e6679aba10879dbdfccf4fe34bb629ec1f8c1e5f24c13d
- MD5 9e9265dec592906ebb3b9e5cbf703351
- SHA1 e02bd25f72630941360f190d0a55c9075e6f9a50
- SHA512 b5e6a0c7cf15cfb11da80227a20f993228a224f6cf0ba8d7925e26839b0fff145c0d86f01ef4b0f5c9235cc1c512e27f212cb0f2bf8af350d19504bd698d5cac
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxk8SXzpn9t6YNG:ACSjGoLpWM6VsBEjxkZdRk
- TLSH T1AF935B6AB28DB376D0E299B88E0DF2E5BD397E300F19185FB59E2F0DDA760C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXD20F.tmp
- Size 118KB
- SHA256 b5962a9f6e52238603547266f214690dd0a3f44c27031eb7c5d380b6740183f2
- MD5 1bdcf6c64654bded9aa29debee419580
- SHA1 609bf08c7db168a23340e132ed89d47c89264085
- SHA512 effefe7e57cb67049047f4e459643265deec599b55720af48589886900cfff77371b0d434fbe2b6458a7ce3f30c2b9d3904aba4ae26fadc3e523fb6e0f8d7a7b
- SSDEEP 1536:87qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxE8SXzpn9t6x4GZjzQwK5WW7VCny:VCSjGoLpWM6VsBEjxEZdQe5BV0HS
- TLSH T161C3AE69B68CB377D0E299B84E0DF2E57D697E300E19085FB59E2F0DCA7B5C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXD5A3.tmp
- Size 99KB
- SHA256 ea68a190c49dad0f71b2cd66a165cf0d0ab6ee469b9e084f1a43e04d9f8bf492
- MD5 6be9b0a672efb02e6e72bbde4c6f537b
- SHA1 0ae31f1b2c63071b1fa05b08ce645bf713fc19fa
- SHA512 d7cd098a19fe5a8c9f4883169592595ec7de50d002a5823eafed06f53253b29d326e16b8361a89d93fa9d8e3fc794e744897c0d43ecdd155d23522f6d5d7ca5f
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx18SXzpn9t6eqkSZZZ3AN2:4CSjGoLpWM6VsBEjx1ZdJUAU
- TLSH T164A35C5AB69CB3B2D0F189B89D0DF3E5BD397E300E59185BB29D3B1D9A770C1190C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCXC387.tmp
- Size 91KB
- SHA256 d64ed1f0886ec2d7ce8983602d28049745dcbb665abe16ed7f923d7d948388a1
- MD5 6332d91268795132168ce1caa9e54bd8
- SHA1 e979729a92ca791c91b22bd518d3aa623a523505
- SHA512 1aff3f628f3a8f067a5a1b5cf4fdb0e1a6d8b9150ce99199645c6bf155568add0316927b40f7afce1b80900ee8e519f534332d88b590356b5f470013f8862b4c
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx38SXzpn9t6cNu:4CSjGoLpWM6VsBEjx3ZdlM
- TLSH T11C935C6AB68CB372D0E259B88E0DF1E5BD397E301F19185FB5AE2F0DDA760C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXC542.tmp
- Size 91KB
- SHA256 c634dbba1f300911f4d72583f9830b27c68e7119f47054e1fc61fa956b462988
- MD5 3a61d8cb38c6f096f43c898c8c3f18d7
- SHA1 458c6e33e9606f42f7997bfcf81519dfff49dd01
- SHA512 8063eea7bb77c3e693e069595527acf3ece4945f7160049c4f8a954c5001b73166fb94607b26fd770874bde15175662d974079873f82817e3371ed04be0721db
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx/8SXzpn9t65N+:YCSjGoLpWM6VsBEjx/ZdAc
- TLSH T12C935C6AB29CB376D0E159B88E0DF2E5BC297E300F19185B71AE3F1DDA771C1190C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXC802.tmp
- Size 91KB
- SHA256 580a5632b59bb6822caa68a02354ccb1325ba2d71499b350edea55db5faf6a2d
- MD5 1b19be8949f8b2fe57eb537f49d43d3f
- SHA1 871ad9c1e319a32627e15f859a13f73bf8f4405d
- SHA512 8565b9f50c9685e255857eeb1306559f80209b8c01d229f93725a1827ff185d606b55d4cd6033e314995ee7fea16a0a9738effd0dff817f088374921f64f847b
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxf8SXzpn9t6mN+:wCSjGoLpWM6VsBEjxfZd7c
- TLSH T13F935C69B29CB376D0E259B8CE0DF2E5BD297E700E19089F75AE3F1DDA761C1190C281
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a360A.bat
- Size 824B
- SHA256 ddc22f62f14dcd13e66e1caf6cfa8c2acfee1ddc7f44717629371f184589ee86
- MD5 9efaa3f34c550a1aee96666a3f0ee7bb
- SHA1 7d7d77125d5e2b7add0a31430fc98a1c581000f0
- SHA512 4180aee7c2dfd2a7c3f54f3181f30a5140c31831b6b9866ef2199e88956d83bf0556b03b05aaf52f219c023f47eb922bbe3ddb887681ec355bec42c6956fdc35
- TLSH T1FD018819907FD9990477E4939977DECEC0633E0D3B0E37059298C50D52D0C6AE8967C7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-07-12_8ecb403cff74d7b8e8305aa0fd6daa4f_akira_cobalt-strike_elex_hijackloader.exe.exe
- Size 677KB
- SHA256 fb6c0990e4976b9a98320e0912842ec11aa380a0f237affd35ef9ad2e7667905
- MD5 9ffa3c77f872dbb0e850b2b2bf7719b6
- SHA1 20a022077000802d8aae7abddde9f0da96f31249
- SHA512 90b7aee4ca245b9681f2aaf228379d42bd062b70955c302d9162ccb7b7acaaf5f9ac20f6fdf65d9b5084c55afbcefd8273e19f0af7d950928d1ba5f68fd454fa
- SSDEEP 12288:kN4fGjLKf/ZIClyBOUFKJaGMsL2rn65hYgiOXtCL:QLKfhIClyBZGFQn652EdCL
- TLSH T123E46C43FAC51EA9C45AD33846579322B731BC481B32EBDB1384A6313D667E16F39398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 9c8e3226b89514ee0535207c12d4563fd689726db29d1311e8dca864ddb4d22f
- MD5 656a438fad6c4561b6e81cf04b3c7c49
- SHA1 7bb5927b82ea3f084044c68a45f5eb00c5a7426f
- SHA512 caf693c62a0b158d5e3049918c8947731233b1dfca880de0254cde495133cf8e7255975330b98906d0947a0d19d0126df88e87bebda7c689061295c851b499a9
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxX8SXzpn9t6GNh:wCSjGoLpWM6VsBEjxXZdHX
- TLSH T1B1934B69B68DB376D0EE59BC8E0DF2E4BD387E300E19185BB59E2B0DDA760C1190C19D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH