Analysis
- max time kernel
104s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 03:19
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe
- Size 790KB
- Sample260804-dvc4fsvsgz
- SHA256 14413fc25b5f1f367eb402e6a19b4c949d8d6ee232b4e7301af3ba19af9433a6
- MD5 1abdb21c1c6b58cd6b899e47fa5c6b75
- SHA1 b8733a13960f60d2cfaa0d45eecf4e084df13ea2
- SHA512 88ce7e7c7f373a1b787efbdada3dd3fface8eace4d600407fdbacff59843341c46384772142e9881b4eb36296e82312ca6b1396bed680748b298fbe1f57cff8d
- SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQpLb:KIifqFu1//IifqFuyDA54GX79lSzQpLb
- TLSH T1FB059E07F6E244BCD517C13089E69372AA71FC225630AB7F2758E6213F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 42 IoCs
resource yara_rule behavioral2/memory/5956-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c56f-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b2cd-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f9-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c8a-58.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001848c-107.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a59-252.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-313.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-464.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-495.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-556.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-599.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-624.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-715.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-740.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-783.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-796.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-839.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-864.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-883.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-929.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-948.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-979.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1016.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1047.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1084.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1133.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1146.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1171.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1209.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1318.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1331.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1350.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1369.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b719-1797.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5956-1992-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5236-1993-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 5236 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe - Drops file in Windows directory 58 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5956 2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe 5236 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_1abdb21c1c6b58cd6b899e47fa5c6b75_cobalt-strike_conti_elex_hijackloader.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5956
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5236
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 790KB
- SHA256 14413fc25b5f1f367eb402e6a19b4c949d8d6ee232b4e7301af3ba19af9433a6
- MD5 1abdb21c1c6b58cd6b899e47fa5c6b75
- SHA1 b8733a13960f60d2cfaa0d45eecf4e084df13ea2
- SHA512 88ce7e7c7f373a1b787efbdada3dd3fface8eace4d600407fdbacff59843341c46384772142e9881b4eb36296e82312ca6b1396bed680748b298fbe1f57cff8d
- SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQpLb:KIifqFu1//IifqFuyDA54GX79lSzQpLb
- TLSH T1FB059E07F6E244BCD517C13089E69372AA71FC225630AB7F2758E6213F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe
- Size 904KB
- SHA256 3227f44f5da46b1d208dbd4d947fe5ff6a3eaffdfb0627a6d25372b78934c111
- MD5 5c7a711abe9e8ce39c74a99459ce6c6b
- SHA1 8b9c3d07a416f3411c5b8bd680c3d6c02dd86a96
- SHA512 64498d0a34692895f07bee19010bc2b2be707a38d09cf4b1c15024c35ea4cd0d44951066ccd802493c7784d67fee246122bb541f0af3524ce7f629268e67e7aa
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLZTjE:WqFgqFUHzpw
- TLSH T1AC159E07F6E204FCD557813085E69372AB71FC621620ABBF1768E6212F21BD0AF3A755
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 62cc750241babefb96890f50062247976daacccf07e74da7685f38527fbc1686
- MD5 fa37cd1aba46af925083c505868e1a69
- SHA1 bdbc8a67afd93edabbbb493533568423ea28af6b
- SHA512 1b9d5e0feb628b71576d964393adc10080906433360875e1c5c8fc35a4965c05b5f06e887ea12e72702258a8a50652e55cfe02194381be51f5236a01d48afa7a
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLH0Le5ji0hmxNrM:WqFgqFUHzHPji0Aj
- TLSH T13F556A16F6B44279D063C075C5E2A3B6EA71784217309BDF1399D7283F23BE19A3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 804KB
- SHA256 dbec2a8516d224aad80a1ec1080fb7c9f0affb78084be0c0c2636dac67686493
- MD5 0e6a83010671634bcf02db403e798112
- SHA1 5ff12eae983e4d6bbe65bc5275ca5aea507c7575
- SHA512 b80dc8757b0ce2f09edac82f82a6cfb12501da5111d1388c80df1a7dba6924bca2104113e0cca82bf684bcc51f0d7d57e512d7cc25eaf9ffefcc0eb2acf9693f
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLZa:WqFgqFUHz
- TLSH T1DD059E07F6E204BCD557C13089F69372AA71FC225620AB7F2758F6212F21F90AF2A755
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 837KB
- SHA256 be1b4d266d5edd88a4f3109b02c2ad1df8a305fb76a50527f37aaa9ad3cbb9c2
- MD5 a8de01cf6285e6abe8bd0c68c8451871
- SHA1 57b7b26a25f88493b343b56fe423655b7282de0f
- SHA512 dfecf0c55d6ccb629a777c360581bab4cabf04653be7dce5de7a86902cf44d88e2b1b77865b7b7039113f0dd7ff964628af6542bb7c5c066460ec49fcc3a67ec
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLKb:WqFgqFUHzKb
- TLSH T11905AE07F6E204BDD557823085F69372AE71FC522630AB7F2758E6212F21F906F2A719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 813KB
- SHA256 287195d911f71c95e91ee196f91d5c6c10a8aecc1fd0afc36cd0e582f88291ac
- MD5 f2875da6b42674b303a11e860623e02e
- SHA1 c0b4d52ba645f0c484eeddbfd78f3a5d68f55c89
- SHA512 d58560361c19fc6dcc3e3e1594d0eb61a9454c5bd4898f71d0dab26193bc53a1e91c902c3bbbb2752b588f98a2924195c7e6cc298d4a75bd8d727f22cf985b90
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLQ6:WqFgqFUHzP
- TLSH T1B5059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 813KB
- SHA256 2a16af9aa39b10f9e5f29edd2f08cbd8fa46a0fab7e8273b330f4814a0ca782e
- MD5 e6ed9e7f73bacee093004da294672779
- SHA1 bc936cbe909588022d84c6067ddc24486392b3db
- SHA512 034234f55e9959c627310a77cc72900624dd71d53d6347383b254c04817ecf8c8e8d9f0c9b79242cbadf9e4c91ea55cc778bbe7eb6ae7116c1cc37d1ac5ea408
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpL49:WqFgqFUHzc
- TLSH T177059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 813KB
- SHA256 8e6cc3befc910b74721b8c001de9e1d0a01f0a3803162f57d6b97d08488c7a62
- MD5 6abe3fb0846b6749d53d6ef3ebe9492f
- SHA1 0f77f6b445ea95c745441d03225294544794a3e7
- SHA512 34765575ced0d9d8dda0ae2cc9bce3f2892c169b5090ac87ac8932e7f5ea43a28df8e8b3a3a96b9a68ac48ad0455429e67f5f06136d7bf623fe9cebb68706bcf
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLgc:WqFgqFUHzV
- TLSH T179059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 813KB
- SHA256 8c271e4196418d37c0b2ce4866f692799a74ef199ac1281ab456861d4bfd185e
- MD5 cb603b05c77a658bbf3cf8ab230c3e3e
- SHA1 9e87efa5070b15651c7c55ad1d00e6d29d4b89dc
- SHA512 4563936183a555c9b8beb23ddd3aaef537608b6c8ac9b3d1fd075d405eab7bed47e3bbea5dd0dd30680811bf5665535991f084b894add53b439d7b4f7a549ef6
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLJp:WqFgqFUHzb
- TLSH T1A4059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 813KB
- SHA256 a6558081df3542af3149ab4f6a2d8143474ce25b476e010cd71a433c97034b20
- MD5 78ea79e19dcab4baa0d095e90d99d814
- SHA1 da37d9f38eb9a9c6ea2a1919e219626a9c720eb7
- SHA512 3932ebf9d391410ea87d3eabb60e027f845b8bb568c1fa179d170d44d1cfacb1e4e528b09d910d07f576bcd9cb93c764d0a7a0df8643dd419bd6c774131f8a69
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLON:WqFgqFUHzg
- TLSH T133059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 813KB
- SHA256 ed049a66978cf63447469bb1ac81c858951e63adc881360481c5a4ac7c653139
- MD5 5320a166410fca8071ff2e63d1b8ce91
- SHA1 2e3439859e60ee0802faaa03c6aed7f7d4542852
- SHA512 c719aeb6b827ca51209c087466795474c2280cfd6c2e2c30d335b415972af2f03133b5a36790c906d59767a2cc9d48d328594956bd9fd2aabd69a1298f38bcda
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLyF:WqFgqFUHzW
- TLSH T137059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 813KB
- SHA256 4029fd9cfd081358628e8725be55ff929d807e4a306f5c349d51aea46bc44a47
- MD5 ddd3044010a4b3d7067683d45b3d1fc4
- SHA1 955c7674c48a209b92c13a3e4cd7f375aaa534bd
- SHA512 5825a6267575652d212077fa2b8895c019eb052fe43a6f9e0520f801d6a7b3fa853700b13569fbb561996f7197f0ef367eaa37015b6c7cd6f7b75557bac2ed44
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpL3C:WqFgqFUHzS
- TLSH T1E0059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 813KB
- SHA256 58028e57b9bed3177c7bfc46e0320956b1d551de8d4262f58927e6759e8e9793
- MD5 ca4bccf183671e3dbbce3bc4a93842fe
- SHA1 7ae8d97a5ae2d0cd3886690dc1efc046b24157f8
- SHA512 ba7794a4e1cea20c08abd9ba461daf9813841a6192a4e639dc8337b876d0b140bf4694a020591fdf23db30a29c6d25b78b4465ba7682127f2924759777b4b881
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpL4w:WqFgqFUHzn
- TLSH T1E3059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 813KB
- SHA256 079e0fba62d091035cc92f07db5909aecb6b5796c571ba65c1c4846c4bb27bcc
- MD5 408ea6e45c1b8d100e08839b0bbdb193
- SHA1 42034fefbb3b44f1220e5c2a4acf45c24de7011d
- SHA512 fb39fd2aca4685c4e9f322be5347b39eb381d2aa165b7a730b89f761866957b58f5a9e5276313172e5778f53fe43032e327036eaa611a46e7bf7d552871a950a
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLXT:WqFgqFUHzj
- TLSH T101059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 813KB
- SHA256 dbe6999f76eea16441c18124937fb784b8a5d52e7692eb2fb7d38b4e7701fa46
- MD5 87cb8ce703fc95af72b89ae62cae9bc3
- SHA1 6b31dc1e8a5abc59dea2949e21fe3a20f96a3993
- SHA512 b77287edf5b40a6f078817386227dc8a7ce24098e38b6f2a60b172c7cc341e7af698e61bea11c85cafd3cb28ff5096a209edcc9783f54c56642eb16e797010b0
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLhu:WqFgqFUHzU
- TLSH T1D4059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 813KB
- SHA256 05352e818dfb7d9f0d5361e8aad4a3ffa28b33ec106bab377c010574dae2d648
- MD5 ff3ba787201092551e153b08cc93c922
- SHA1 8d8e51878789b6d8fb4ac0d41c0ed54e9562c518
- SHA512 6db0c35e0c71945ba69151296d71c885eb5c1f66b61d807aaacfa9244fb911bcce2fb70c2bd51e784255219f5fd55e6208c20f70f6a24cb99ded193ba936c4f5
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLJb:WqFgqFUHz9
- TLSH T110059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 813KB
- SHA256 3960bb6f7ed3d203ee9be45fca3707a70af031d84e7ffa9b3700ad54f1f3278b
- MD5 be4fb128e171fe5edaa5e9f2f431e96a
- SHA1 6a92ea7e36e7b11d51a28398bfc7de5dc539a002
- SHA512 377ffe46ccd0e4ab91229e56185acb051e8dcbf53dbcfa94755d3ae9340074e45703ae147e7d24da1264290fb7742a59391af7f5e75d478ec4164ceca2534c9e
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLxf:WqFgqFUHzt
- TLSH T175059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 813KB
- SHA256 eda28b23c18580ae652c327d5a200161d308c6e77a0c8ceb2e58abf25e50d7ea
- MD5 69d6c9b133f75573ea7c922b0f7b40da
- SHA1 625b516de59bf6c80d0288f56a70159c4fb6fc70
- SHA512 c0492a0f2724c6c9367999546ed419c89ff364959ffb810aeceb112a4b677d3e4c4b2e88ac2a0bfc9b64bfc2a03ff347c98ec0434bedb2583f7da24e22c21749
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLaK:WqFgqFUHzl
- TLSH T1C6059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 813KB
- SHA256 1a2de969233762966631c5c19fe001a5af655cb1fabc6d6acf1ce5fbf2efc5fe
- MD5 d65a18e60d41a4acea1030eccf27054f
- SHA1 b0d62c970a595602c37e7f379cec25235898155e
- SHA512 7a36338ebfcfb45d58035ccb49c481ebead664e9eac0797f7162dd11e9f474409524173c665d74ff031c7e358188502cd33e1beb37c2f6528211ecea8e63b56d
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLPk:WqFgqFUHzM
- TLSH T181059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 813KB
- SHA256 b4627fe37cd2b31f16ac96b986a6f7ac58f1b7be0f4c9bbc5e0f78f6bff4ec1c
- MD5 62678806083cf5fec55d27e84e074a5f
- SHA1 825d44da3462f84ac9edefd9e03d01f2246a3fb9
- SHA512 8e37424a2a2bec923ccc467ef36813cd0ebba4ea492605372764cd340e8a6622e510d02a93db4dc6ce9d0268639b43caa0e38ba1d7edb76ba55a5329e28db544
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLI0:WqFgqFUHzl
- TLSH T1C7059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 813KB
- SHA256 ef2d32edbb5dc2bd61460e5f29c86b872ecfcb9b589f7b6c8263cf8b23103257
- MD5 7dc7e3d6905ff870bc0a96dc00f5da52
- SHA1 410ea4a6bf1eef600b0893daa28e7477af3c4e1c
- SHA512 ecdafab9507d1f65af637bf0642d9da2a5e67f980234abd52ad4949095da13d14ac101397869b3e80bc053985f0c3c830593d35e2f866d3a2b780246ad01ddf5
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLjg:WqFgqFUHzE
- TLSH T18B059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 813KB
- SHA256 61ea7e770d4516246987db26a8189a5ccf2dbc1cf6285db42b122405134029ef
- MD5 65e357ffc34a05b7b754daeb257223b9
- SHA1 763882652046808ff29426bfd15264b3b13731eb
- SHA512 2fe976d694052fb1bc1608a01f28795645221c9daae9d074be8f0706a70cd689a8f1780570deec754d8314bd204c42f2bdbae49e5bd22f7d6a6215e791f78882
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLer:WqFgqFUHzW
- TLSH T174059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 813KB
- SHA256 209d161fdd15e61081bb8f37aaa8fc3916044351741727e6b71fae34a403ae28
- MD5 81c5e30dbb85fcfc0b6d18e0825e7e5e
- SHA1 f13b816aa2ff70693d6eafd949800709ab29c480
- SHA512 3d79d947536ad3807031f53e6b39983dc7252fecee7c72a1b3d63850970b80460a41faa66e801b11e4e2ebe5763d906e90e5cdf05d0c7ad51b68ace940437867
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLEn:WqFgqFUHzQ
- TLSH T1D1059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 813KB
- SHA256 9b268dfe2bfab6c2e6a23656026d9a373036142985bad9958f6fec244fa2aafc
- MD5 d0882c45d213e6dd1758a47c28d397c3
- SHA1 e6aa3476d325f48e30559e9c15f29cbf691c78ed
- SHA512 96025d06ef0189de8f01ed805ae5f364f3e7fc7479e5e8fb9ba0f0596d0e78c04a34b5a35fcbb5ff282e9a47674a19c372ecad2491829b92d48737d30d6f36ff
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLSx:WqFgqFUHz2
- TLSH T10C059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 813KB
- SHA256 67cb7abaf256e40e324ac12aa6d9b35fd83d89f188cfa0e61bfd776fd4c21849
- MD5 809ced15c2cbaa071c4d9c7177494000
- SHA1 59c008250caf19a007fd2b3bcb5f7aa644fe35c4
- SHA512 bf97472e84136d2b707614ae3ea5a818f124c1b23a8e370935186ec4469dc58a2a7a742d8d4fdffe27292cedd9e05438399c3ba9cefff5e572ff66faad49f705
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLkA:WqFgqFUHzt
- TLSH T10C059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 813KB
- SHA256 a28eff0830c2fc5c36a72a893b9a44a8d832bcb5333b1af3430f9573a94e6519
- MD5 806e551a4294289aece56006267016a7
- SHA1 849410e330ccee704e489c8507bdb1ada8391705
- SHA512 ca2bd634922b9d3063e9f85e8cb8a7b2c36f14781084b45175ff6c3fb6fa5ef54bbaf17e070079d7435898fbf1b64a139af1eee439f08d58083da1cd4470203a
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLN9Q:WqFgqFUHz8
- TLSH T175059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 813KB
- SHA256 1796706e521cbcaa838a26699da3bc9edb1564ad85423137e74f99b4c11bc3de
- MD5 6b7794af674af3b34b648ae3a9417831
- SHA1 2aeba1ef8eb622e247edcd032be75a8558e51c97
- SHA512 ae0c978d16964fc076845c7f1b7cb1dbfe0ae180d9043fdebf45c92750a001e3f10abf452f1eed8ca1da245ef3ab658c1e992d867f544d070e754513550fa8d8
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLo4:WqFgqFUHzX
- TLSH T1E5059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 813KB
- SHA256 f0b7a774375b21c7c34238c07d6ae6f2eedcec6d007efbd444d494fe051cff3d
- MD5 bb607f41ca77784b16f0d86a90561a8c
- SHA1 0aad31ee4444aff85c23e6c6191b483f7853da72
- SHA512 7dfd905d7eb02b4370dba92ef6cdd8d117f528a802699f8456e050f5729918249da840c6343a6dcdc663703b6c54e08fada3d150fd2883c1dee97719007416a8
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpL7u:WqFgqFUHza
- TLSH T124059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 813KB
- SHA256 6fef752d3a58ddec5ae9ef7700e47592fe79ba27430388e66395b74d1daf380f
- MD5 517cb2d704078b2a41ad3e663a12fadc
- SHA1 372f0e25afbfcafe19e2cc5d2ba792a090631a5d
- SHA512 ae1213a4a9113f613b16c090f95caa8d6dfd9a61140243110d32913b937a0576bc2dc8fe61b0fdb4a6224578f46f7c69acd6e21f7c039d1c203b034ed4803cf3
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpL2j:WqFgqFUHz0
- TLSH T131059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 813KB
- SHA256 790d32df2a7207362ee7dbe0edb769f2550dfc719e2c8e6ef05527e89f741669
- MD5 a41b97eb72ffb16ec9adf733eba95873
- SHA1 c7bdc33a945c05578939759f6aef9af5e2b3009a
- SHA512 4864daf3a054b82a300c3af1bd29909c2eb6a88cc113cd65098d8c66794792033368ed46ec373105a8a634910c687c65e2a0cd24808b308452ddf302a9523a1d
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLjg:WqFgqFUHz8
- TLSH T193059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 813KB
- SHA256 247d391a72ee8f4cb29610af60f0578ae2a7981a0e59ab04c3c066c3df8c55b3
- MD5 fedca26248cbfa9f83fce54fcf7ea585
- SHA1 aa5ef58c761627b9d1f96a431d002678da3c1ebf
- SHA512 51dd3c8c83a9f80f72f8976b028d02273f791e3b428be1c3d9d1ea921673a074b0e736e2daf867fb730b8d016b0533f4162d7776cc5af5ece1e68945367e9902
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLeI:WqFgqFUHzV
- TLSH T1A6059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 813KB
- SHA256 b79bcb035aa28cd89b06a6cdbb758e9c6e14e1600fc7dfe7ab5ee96d755428f3
- MD5 2d560cca0402224bdc80d5d9e9fbbbf3
- SHA1 4294c218373acb0b772f5377f5e76fb8d1a6b8ba
- SHA512 236f8c3c3f1f42dd1fed01aeb2f65f62f85151a0e2f049c93de345b7810ff2c7dd26bbc88cc89c4b9f231db8d5413cea144b08c842a43cdbff7bdd48d72fd861
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLso:WqFgqFUHzD
- TLSH T1E2059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 813KB
- SHA256 699f7efcec1d6d85e151c8c6b2f50b4e99c064220fc22d6fdcc61d4847cacaa5
- MD5 3f7ce21919a6c6befdca6440207aae05
- SHA1 8edf50defdd2c50f86b8eac608db74f6d451c028
- SHA512 b9c9c4857215d1d7f558ba7c30c05a890511d3b8de913164cab959b08a41ab39a10df3b4c8677c42a6026f03861356d77cc7f52eda35d494a5343f6a86a20212
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLv+:WqFgqFUHzG
- TLSH T1FC059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 813KB
- SHA256 a92214caa72e73cabf45f7e02085f7d82ee7af0e3de76e1d963d04a8bbbfa8bd
- MD5 f4d59b33c01581f9d483409db5f5cdc5
- SHA1 625f62672e404df4673075f6419754f222974ce1
- SHA512 f08fb0bf02ee5c17127d8c9eced6bc2f3947ae867e908878b541262d113f137da63bda4d0b6669cca0bb42e126736b5d7db35a913d25c77af4f24ce933a045f2
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLFQ:WqFgqFUHzC
- TLSH T1DC059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 813KB
- SHA256 b332f0262458812c09f5ca569a4be3dff505ba67e107a526c246c1a80f438175
- MD5 02b4b12173bcb127c0f74fe501c2ce1d
- SHA1 f66c57d40966f73d1154dacf1c79f116fe282b90
- SHA512 83c9fa5c5188c74fbe959ed06907505f03ab93b9aeca3d2460467781b8eecbf886799d79f3674dc8da60377397d44dbb607fa52f98699cb4f433edbbae24da4e
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLKX:WqFgqFUHzS
- TLSH T165059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 813KB
- SHA256 6ab10b0840f8f6c0826b1e0699154f781a1cb271bab22fb19345ceb110dff698
- MD5 8c9cd3c930aeea065229e2d434592bcc
- SHA1 f18c101d32e91920d590fc2dbaba4b3256d2a706
- SHA512 129157a0d0ce1105e4723db2f9825e07c960ce68c239ab12d0fa7476a0537d813eba22aa46809af577195832533126efbe2a6dd657516e1f44541f75fd0abff8
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLsL:WqFgqFUHz8
- TLSH T14A059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 813KB
- SHA256 c19eab40fb4106a1984f8ee747fd36119ec27e3634bb8373f177d45a64533237
- MD5 b8fd5098a5fda8d58c3b565ab40510b5
- SHA1 6602368b4702cdcec66ccf1ad4177afb2a600ef1
- SHA512 2a781d8e9606e54514ab93d71115c0f923b79e08e432296cd5ee781af2f443d799781de31d23e7afe7d202484039665538da43c957cb22e8d92ce633b4428e91
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLoM:WqFgqFUHzN
- TLSH T1D7059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 813KB
- SHA256 82be158ce4574cf1d52edc26dd1ced8f01f271c7d9f336ab80810a60590e9cbc
- MD5 ee572a2e20d402162daa7b8434ef997a
- SHA1 ad83f14e58d71ba20a21df47bfc65ebccff52149
- SHA512 7b9384cd25463382c6e66f70315815bd1ad4a8d7fd3140541a3cacf7456487ce0a7592708098ece4912f91deb5d18ddd8cd02158872f95f390e5cdd24b42f01b
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLJh:WqFgqFUHzn
- TLSH T122059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
- Size 850KB
- SHA256 bc9bce9729bc85cf685ee311224ac333bbf66a15486f5b509c3e1a175dd752ae
- MD5 f3178ae18d8c5654251ec062d22b980b
- SHA1 a1ac8339acd187670ade463cfc654b2415f25124
- SHA512 fd74bc608c526745cb9d59fff7c9b21e844ec0d3c6302b452db472b3036b10ed8a08bfa5ccdeb01482640c560c8ef1dd10f4fcee1b6c9f2bb3c3bab68cca3674
- SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQpLujv:WqFgqFUHzuD
- TLSH T1FA059E07F6E204FCD517817085E69372EA71FC225620ABBF2758E6212F21F90AF3A755
- MD5 SHA1 SHA512 SSDEEP TLSH