Analysis
- max time kernel
87s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 13:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
- Size 803KB
- Sample260825-rakvfstbnf
- SHA256 37c9439acc80aec6aa007789e2713ba63055aab30331d01ad17df501ddf695a5
- MD5 49d2a4120813c904cee096e2994002ac
- SHA1 f19ddfaa3e2802f7f38a6c68d1d043a2afabb61d
- SHA512 aaace6dab1ea3e8810044ae3c1131e113cc5d1e9c911a0d0d58d03549e0e8fcf826e12dffc30ec71df3fd421c79cbfeaef309e4322b60fe63911a8b0f528178f
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxF:8o/CKJsGWDMCF
- TLSH T19C056B1CFEA48FBDD9920634C466C72E6275BE204812E91B339CB64EF970F42752E653
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4136 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5564 2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe 4136 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_49d2a4120813c904cee096e2994002ac_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5564
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4136
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 803KB
- SHA256 37c9439acc80aec6aa007789e2713ba63055aab30331d01ad17df501ddf695a5
- MD5 49d2a4120813c904cee096e2994002ac
- SHA1 f19ddfaa3e2802f7f38a6c68d1d043a2afabb61d
- SHA512 aaace6dab1ea3e8810044ae3c1131e113cc5d1e9c911a0d0d58d03549e0e8fcf826e12dffc30ec71df3fd421c79cbfeaef309e4322b60fe63911a8b0f528178f
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxF:8o/CKJsGWDMCF
- TLSH T19C056B1CFEA48FBDD9920634C466C72E6275BE204812E91B339CB64EF970F42752E653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 8abb03bdae3b483b2dabdcf1ddf20c1acca0fb51b1ceb707048a0697da105890
- MD5 6460396360ebd124d9cbe90f43bb841f
- SHA1 903d5971a46992c9179e744ec83b7c37c57fa5d9
- SHA512 d0248177551b31f478b443c1c330a552056a5d9fe3ff22d13ca78b386f765eb32b534aff677d7e4b4ad46b7c4ca2c5e8292300af65a594e87fd065e7b1365d6e
- SSDEEP 12288:8o/CKJsGWDMCPXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:hzsGwB0Le5ji0hmxNrM
- TLSH T17F554A1DFE648F79D0628174C4A2D75EEA313D51073099CB2389B62DFE32F92953A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 817KB
- SHA256 3d9ae3cd5d65e625631a5b2ae858c98c31eeafae08abddfa4ed8f577fbb32628
- MD5 aec32ac9d53583e9057d0120fa694ed9
- SHA1 d1a7f9d0782958687292175cad2f95f829a39d20
- SHA512 ff723f294a72f72983ab38ea7aabb2f978772aa252c05b47b3bde4f08e5bb3db87e630890eb96057e9c3c9dac70e3d44af45fce4dcf9cc47506e38cea71f5c5e
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxDa7:8o/CKJsGWDMCDa
- TLSH T1C9056B0CFEA48FBDE9920634C466C76E5275BE204812E91B339CBA4EF970F41752E653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 826KB
- SHA256 f148e4362016929ce4409c03c03bbe380ecfeaae21ce8f59d5fc46e09d7714bf
- MD5 602a716a58cae3659eb5914393c3081b
- SHA1 f5b10d963582a0bb8f1e7ae77a8a23205eecf8c3
- SHA512 8ad98b44681715a66888328c5fc516b9baa45015f8ff524d4ef247bd4e126fe0d78696941814a9d5d64dcdf3c9cddffed62bafb1af4ef2372b1ab39e7d66ccae
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+Tx1E6:8o/CKJsGWDMCi6
- TLSH T110056C1CFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 826KB
- SHA256 aa33b7deff7a414b0923f4dad731468c803fcc1e33139c291e639e96f8a76f65
- MD5 815c064206f53024bf786a6e8f6f21c9
- SHA1 841b901f05ed63531cfec1fac872055080fe70a0
- SHA512 e3fde76eff2c7e4ba05aeee947f39420c4d44a67f641ab3d6f6a6362ebdd9b9f95a13e4ae45b380c137889b61eab0fea2c4a6580af0d83f5fca68b460343cee9
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxB4N:8o/CKJsGWDMC6N
- TLSH T18D056C1DFEA48FBDE9520634C466C76E6275BE204802E91B339CB60EF970F42752E653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 826KB
- SHA256 9f09d0f72efe95555224925e82925485bac62a042ae2750900e9fa28b7d5f0f6
- MD5 462f40cec891c040f4daf188ff9e5129
- SHA1 2074d9137e3af7cab30ba07447afb96d18768300
- SHA512 09308ad6026eee3257cd21de72789c1575ee8c2d8609a4d3da9bea0265198822535ee2510d4910c259a0a900a92d1c613e838b2aa6d8d116795d8ff623f62c29
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxBaf:8o/CKJsGWDMCgf
- TLSH T12F056B1DFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 964KB
- SHA256 b26d5a05e8b03d110e98a0b9ddcb2fc27d69de27f3e8686759b7b994c612cfac
- MD5 8c20a6c64b51f4e7527bff61fce85ab7
- SHA1 c5b5fd928bcd5765c4efe4e244ff42860fce908e
- SHA512 5491000716a14d2d53892c562346027e87ed804919da621f7ee13d372ecb121644907bc4aa623f22983a3312955947971580ad03e2d6882d07f2a8f2f3eb8ab0
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+Tx2c+D/0vxBzkiLz9u7:8o/CKJsGWDMC+yPz5L87
- TLSH T189257B0DFEA48EBDD5620234C466C72EA375BD304611A91B3398B61AF931F817D2E763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 826KB
- SHA256 a175684a5c992a4a07f145f926ea24fb721df5b1869208cbc28917d58d15ac84
- MD5 054977985b1c67833c9c9f47f62a8039
- SHA1 61b67269581504eb8cb9d94e9ed9b5d655c5fea8
- SHA512 4e6e40027721fe25614a6a806199f7159b26362687fbc530708cad5ac36a37871bc9101154a6a062b597236a8bddb185dc22a5baab6bcab8a24950dac652dbc7
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+Txfio:8o/CKJsGWDMC6o
- TLSH T192056C1DFEA48FBDD9520634C466C76E6275BE204802E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 826KB
- SHA256 96911063d1348e990860efdfdbad069f4e19cacec05b030e7bd899509ffb04ad
- MD5 fb5a373d622e20b0974511a783a18732
- SHA1 c4e47062d0b7ab720c12faad03f13ec38efc3ae0
- SHA512 6e1e3a43de95de5e0606ec69186e2f4087c1d405764132b51341c866450005a74703fdb1de6132fe502abd3d447da3ed9ba0b6763b57573335f89ea94511828e
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxSTu:8o/CKJsGWDMCOu
- TLSH T18F056C1DFEA48FBDD9520634C466C76E6275BE204802E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 964KB
- SHA256 486a5a34fbfd63d62356af08b5e5294bb5fe938682a508f5215cdd1099721896
- MD5 03a8632f7aa5764c6c7b37fc5f8a35ce
- SHA1 fe2f44f2470ebf984a25b6047d80222274b6ee20
- SHA512 7e9dafb73b7eda926452b17e567918489acfc5e98c45714497f7d87bd741374c3ec7c19dfe20dc2217a363b0fa1b642e5a28a070a92a9c001682033da1bbcf63
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxZc+D/0vxBzkiLz9u8:8o/CKJsGWDMC7yPz5L88
- TLSH T1EE257B0DFEA48EBDD5620234C466C72EA375BD304611A91B3398B61AF931F817D2E763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 826KB
- SHA256 6cfc1591a435f2b0f9c3ec9cf52e65846aa6c22eaa5ca07fd0df3d54afe8dd0e
- MD5 6dbb80116f90bafa2ff5d587b93002e8
- SHA1 0162767ae04565771a6e19f49420b4863108ba9f
- SHA512 273b25d185e7d4cc46411b88e358b0d2f2dbd03ac37f8319aefda3f191060fefd1b03aaa3993d6f2f3def8e3ca38224652341a13f59e83964e843d8ad4109024
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+Tx9I9:8o/CKJsGWDMCC9
- TLSH T139056C1CFEA48FBDE9520634C466C76E6275BE204812E91B339CB60EF970F41752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 826KB
- SHA256 af6456c6bea4989620389d4c37b705bea19ba3c6450d8df4ccf3d0b0f897c32f
- MD5 69025bb0dd941095492206c864401936
- SHA1 7c87c94808374f3efab9ed6902c356b26ef5fa1e
- SHA512 7d75b5f72a440cc5f8e76adb24d11081ff1d53681b19551f5a27267291999acb200bc44d101ba78e98e5e0c4577551f8736b539d09df45d0d1ac3ca84568037e
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxCc:8o/CKJsGWDMCCc
- TLSH T171056C1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 826KB
- SHA256 87d715254e63fb3a502cac00d70667e8ad87b2f469ed61e597e8a407e610c4e0
- MD5 4a26fed256135329fba10279c9031b4e
- SHA1 e6cabf4d7811aac993ac8fb95983b545a94b8432
- SHA512 b41db6e172e907912963aefe4a177dc057efe706910a87a12fc1ea27308210e1a08636159953ecf7959fdded9dc089d52405dabd13faf055791c526705ffa1a2
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+Txw4p:8o/CKJsGWDMCLp
- TLSH T1C8056C1DFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 826KB
- SHA256 f0be9158370c5c93d81737621ee667e5d7d280eea87ca7c2a00af42e48d4ccea
- MD5 579b305c590a863f7b3d15fa0a9f210c
- SHA1 4f3ddf7f5c917d90d0f01109338f71b19200130f
- SHA512 d66f694e95a4abad031ebeacf717055865f643617fc8e81265cd53a00564b76961d0bc729cbd36ec3cc7bdd5a504570a990dce3a58e14c4e98628c136dd638a9
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxbRe0a:8o/CKJsGWDMCc0a
- TLSH T1BE056C1DFEA48FBDD9520634C466C76E6275BE204802E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 826KB
- SHA256 bb1f8b1c8cb20aa06f239fb7582f46eb8fdbe809d45934a8afdde58ae266ac4f
- MD5 b63949b1dead64f3373a6db4d5f26f30
- SHA1 e5cc26378ba0ab93d611963149ce566254ac1b91
- SHA512 033637ed3a9af20e697349f4e8def5f3d2007802d50f50b96f73346542f3b866614b2ebbbdf2d0947bad192d32f540576641c676ffe882f659e2ebbdea21b1e5
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxoxF:8o/CKJsGWDMCEF
- TLSH T1C7056C1CFEA48FBDD9520634C466C76E6275BE204812E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 826KB
- SHA256 5532e338e7c4334aba91c876d207931be1edf6fc1774a9245480f06a1d1c9d71
- MD5 be1d190397adad321b20f16dd95847a6
- SHA1 2ed22ff2373a6b2d4e8834027852f6ca5b3c7a43
- SHA512 3aeb851a87641adbfb374286da9496fbe5b5f5ab8c855846fb4ad53aae3bcc61c6ebd88f129cb208752054ba3ec335a371fa7430581cb7b22fb5e0c4a2d80474
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxBnC:8o/CKJsGWDMChC
- TLSH T105056C1CFEA48FBDD9520634C466C76E6275BE204812E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 826KB
- SHA256 28729a77c8c13169ec2ef8c5d0d7db68397df0b6580e65cc2c0669092c677082
- MD5 acba6ab348f8c75eed0912566b875f29
- SHA1 3ca9451496b9353699786b2b429fb7d841e3d30a
- SHA512 a9b7da3a25d5a8832329f9812ac6bd09749a266c3d8721f161b8a5eb12e39619840b92aae3505344d8e1f6e088d2bb70e0ffd78880b463c5a8ede0ece50b5390
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+Txniw:8o/CKJsGWDMCiw
- TLSH T186056C1CFEA48FBDD9520634C466C76E6275BE204812E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 826KB
- SHA256 adf899ca487121f5554af11c67a2e1f5f594e2e0c96d737b7496579483e5ad70
- MD5 b8fbc6e7b714bf20f48d3abce4a41965
- SHA1 edc87fa7493e4792909115c77a255a2f8bb7d915
- SHA512 3c4abe9757448c1b765a102fbf906bf875a5dcb3df122ac6bf63a8284df94c0e95d9f771841e4ca9a085b823f4cd9514f50870e4f2cbbce51d999277e77e6a67
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxA8T:8o/CKJsGWDMCpT
- TLSH T160056C1DFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 826KB
- SHA256 8e52a55134934e8899ef95a952eb2f2ae3dcb70172f4546a2671be1a25815f1b
- MD5 fa3bbef10b3a39d641a091499a53f63a
- SHA1 88716233a7167fd1c8e4ced6dd630016e121c027
- SHA512 d467a36c06b8e1cb44310fb44c457098ba8dea4b3036b0bd72fb2329bd1c6a29b8ce1c9e90d0d4ec341a0d53f66cee12d21cd520c41857bcede17b0b2ce4bea6
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxHnu:8o/CKJsGWDMCHu
- TLSH T1C4056C1CFEA48FBDD9520634C466C76E6275BE204812E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 826KB
- SHA256 6e4587cac10599f79e0282d5026475d275fa86352d2a5f159112505cda2b5018
- MD5 9eb60186db5ea4372b4baf87dbf86fb6
- SHA1 98e1ade77b55a0433facd9ad61b52ffeed13359f
- SHA512 2a7c36255abf97e55e982c43a2b5eb201f36d96217357018cbf7b4f55659aff20420c8f15b854c678019c8d27352a94391146b2e0d132a192da36f5005ddacda
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+Txgeb:8o/CKJsGWDMCbb
- TLSH T137056C1CFEA48FBDE9520634C466C76E6275BE204812E91B339CB60EF970F42752E653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 826KB
- SHA256 69b8e2734aeab4fe448201969082119164e752bdf1b94c2fe38cdd7476bd8c03
- MD5 c2cbc7ead01728d8843d0f86e671f640
- SHA1 1d529e513760c8bbeea1c91d56ca4567a6ce512f
- SHA512 b4dbdaf958a2efeaef8f3ffa733fb3e52980f719052343531cec72765ee23f0bbbe8072ba6867f7f652b81b4f37bd6c7a87358c4fe23932042c5dfa6dbc975de
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxRhf:8o/CKJsGWDMCvf
- TLSH T140056C1CFEA48FBDD9520634C466C72E6275BE204802E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 826KB
- SHA256 b9ee30b015058fde971ecc5abb5e3280cf647ec14e43f8ae5ff2e69df4476405
- MD5 8323160a0eade97739453dcc52fb4eac
- SHA1 70166607be682127e6616f11d70e4efd89468fc6
- SHA512 16beea8d508d78e078bfb005884593c1ec403c616bc7bf4e8d5c77de7e9d0ad21d87a6235ba42b47dfb73d36670f11d012a7f7707c25b664a621d6d896ac512a
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxPQPy:8o/CKJsGWDMC4K
- TLSH T1DB056C1DFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 826KB
- SHA256 d76626fbe785d4a95ca810e89d1da85e3ad91d0261d6d5121bdb4944dccbdfd9
- MD5 f9dc67fb38f0eeddbf34fb68fe68f288
- SHA1 4c5194f42294a6c7321606fd3157833a3b19d55f
- SHA512 dd4de7913a455a701b91a8bffce6b659cdb304f5d433e0449aca4cf9b610b93a07538a9fe37d82d2b76237e1877ea1f1b99e24207d2ddc080bde1c7c95641848
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+Tx31k:8o/CKJsGWDMClk
- TLSH T190056C1CFEA48FBDD9520634C466C76E6275BE204812E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 826KB
- SHA256 2d82ef2cccd372ec9cb8e2236c5f4c8f0c6832e0dd2ce1290f372883c23edd20
- MD5 6aea64f5313d6ada9ad8fcbd6eb9498b
- SHA1 737dcc065399a880351dc5e0f54d345abcd321a5
- SHA512 fdfb3156c8b15d3e983d83a7145b609ee28876b29d91727141eabf7fbdcc72fc4d4302f759e95c2bd5504e11c81ed2dfe383b58562e2ad8f0e6131e279f76c07
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+Tx7+0:8o/CKJsGWDMC60
- TLSH T181056B1DFEA48FBDD9520634C466C76E6275BE204802E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 826KB
- SHA256 687079bbe0e04998e353cd78755ca04e9386c627e0bf10eb06509878fdaf49c2
- MD5 7e6fbde47921909b45a0d15571baf490
- SHA1 3762aecb1a96d9915856f2515571e336408a081e
- SHA512 03e2ded96c2e60409dea2853bea534f9e09a44bc8343f8c87afd4d7424508763274ab655a53af0e436b74827267682a110c478c9d4fe81138f7c1384675bec0f
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxHJ70:8o/CKJsGWDMCp70
- TLSH T1A2056C1DFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 826KB
- SHA256 c6b18fac96fd75eb72ca7a9862ff79f5f50f64a87ee6b5732661b3ee6caf8c97
- MD5 8689303a9f4e0676063a13a25ada11cd
- SHA1 0eccebea77b159d5af8bb51a897a1dbed9350772
- SHA512 a16cb1c451489fcb473226f360259ec0ad3d1fb4ef1b333415bcaf50cfb24c493bca31dd779b6c7db3b3306c7d58e2ef5b18e748c9e83358990466086fa9f90a
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+Txv4r:8o/CKJsGWDMCQr
- TLSH T1B1056C0DFEA48FBDD9520634C466C76E6275BE204812E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 826KB
- SHA256 207ac5c778812c07b3e8ebee5b2d1157daae6a5884933c79a32abdd097299ac8
- MD5 ac3690606f6c369ed48a4a91bd30d7bb
- SHA1 5bb736ddaa1cc28c6cabc2cd648038572720d91b
- SHA512 1c157e04c48f8cb5ab5ff57659af9340df1ba9d72fec5bc95684857fd5df977b754aed188984d6a80d6348bacd0482ef3726eb8044f547bf6296db24ceb243f9
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxIhn:8o/CKJsGWDMCOn
- TLSH T1C0056C1CFEA48FBDE9520634C466C76E6275BE204812E91B339CB60EF970F41752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 826KB
- SHA256 a2d229a3e799893413cdac6473bc79a9ef296f1d5540a5ead5d7a18f7d1a80e2
- MD5 07720b424fc708762a71c7f4aa95efaf
- SHA1 61e2567e298233b2e988e42c1a67bae4167d4483
- SHA512 b35571fb54786e79bc9ffb04e3cfef69060f22ccd32fed57bac119d5a5b65446f26641a261cee33503feba37cc2eb918c5a52f16f00b46148ba6060b06926c80
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+Txxix:8o/CKJsGWDMCEx
- TLSH T113056C1CFEA48FBDE9520634C466C76E6275BE204812E91B339CB60EF970F42752E653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 826KB
- SHA256 d056e3256a937758dd0c9ff41083fceff279ebfb19af5bac1d75f43a23ec59c9
- MD5 b056708a1861a76aba6cad11343b79f4
- SHA1 83eb7a3753ed0c22a7b2feef813231f3372f0cfa
- SHA512 cada283c2d9620bdcf8b390b3591887425d0ed3887cfa30ba5b1135799d72b7f99c0dcbae3da6f1bf362cd8cc9f0241abd795811aa0d1465170b6e502a7761ad
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxdwA:8o/CKJsGWDMCOA
- TLSH T1B5056C1DFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 826KB
- SHA256 f92c91b5eb5f93b74930da21b633236696f12f58432cc26fdfabb024e1d620d4
- MD5 268272d3d6cd90e4b77e48bfc955d8f8
- SHA1 1726e7c67ce0d764c35c2792b5d5624f5e938f15
- SHA512 00b3645856e0ca985020996cc702e98d8dad65a1d3ae2ff019d6d93bcbb740c4f69923ea2b3bfff467e544b476785069ffe8d8425bcc5862ac3d5ba43c512ed5
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+Txsc9Q:8o/CKJsGWDMCH9Q
- TLSH T1AC056C1DFEA48FBDD9520634C466C76E6275BE204802E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 826KB
- SHA256 c30296163e9038adffa9c15d2d27e50ab15afa80a1d526d506b2794151ea7a59
- MD5 802419c366a61f8f681635a5da4b800b
- SHA1 0e0478ff04b7f5fc1db58030be8cfe00d37be2bf
- SHA512 e4e48c0a26253ff56049797d331f46d516e9996f16811625811fa7dc8c4d8a6538746f0f3146413fcef5f66e35adcfe65d45c3d5bd4083dfe72892ca575433bf
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+Tx4R4:8o/CKJsGWDMCO4
- TLSH T18B056C1DFEA48FBDD9520634C466C76E6275BE204802E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 826KB
- SHA256 05f0418670b740776b90f410cf7ef4642a579427119da9510aa9abee94ee3429
- MD5 47956404adf51cd627e7ee51af4757d0
- SHA1 0e22c30c3da0f9db34fe8914c88e0d19d96fd91b
- SHA512 f9ebd9896d6731c5a89f6c01bddf740cb7e8ffbb58254e0f435a966425e76ef48002bc31f356316da93895b6da19e38fb64fd300432bddcee85b2df867e86778
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxwAu:8o/CKJsGWDMCtu
- TLSH T1E1056C1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F42752E653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 826KB
- SHA256 c0d2e9026a9922781d136273561422c67c11da04d9b180f9a1502d01ed748f6d
- MD5 87bd013ebb8af0359c10536263a14c23
- SHA1 71a1aa406302daaead0f42f689a2663ba4dba6dc
- SHA512 b2c667155cda81c50c48058fdb088a50b06639136812f2958aa71b4e497f8de72de3e2350ad00fb0eb01cd442099af1ef6843036f7f4223f21db036bd614b212
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+Txz8j:8o/CKJsGWDMCgj
- TLSH T116056C1DFEA48FBDE9520634C466C76E6275BE204802E91B339CB60EF970F41752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 826KB
- SHA256 e9f15d0800b2467394e49e638e88076fc3379e7939c10d8f1776b74d7bd3797d
- MD5 c179f5446845b31e06ba22ea19e4fad1
- SHA1 31256dfe7b04b4749ea647045efabf42d405b136
- SHA512 aea21adb01140cd0e04d43ce62ba2850086122116414586fa9b5b67fdf09e15d9b7ae2598a28b18678c1ef65b4efc2f69eb77db7ce576604a4a76765a9402477
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxZzg:8o/CKJsGWDMCRg
- TLSH T1BF056C1CFEA48FBDE9520634C466C76E6275BE204812E91B339CB60EF970F41752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 826KB
- SHA256 ae250995f170b7adc6dd66deb030405114493d003151ee980fa41c61ab9074fb
- MD5 1dedda82d3a9bf1bebfc4f90ccb1aa31
- SHA1 d7a461fea9106a238b694613b55464e9f06fb635
- SHA512 4430d0e6a3e52eb2ee0f693db709a4023ec053058fc8f4fe6f200ffed2d276de627e876ca366958365a2b8cb12106fcfffd7749527c130118378079cd9bfefb9
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxmxI:8o/CKJsGWDMCII
- TLSH T184056C1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 826KB
- SHA256 6932b01c92736e101e53276d9c64b7e62a675fadc6a08bbd0c6de81548c3ddce
- MD5 79ae63f38859d562c9fd0b389384e229
- SHA1 8a755b0a9b8b2b976ef94cfb8a71c7b84f1013cb
- SHA512 67ed7bc6764b0e4d0aeadb8f059991a5a31d21a78acbf6889e426e494b2c0f7a64ccf33602d446fb541cd5ce4ed7073b692c299d1fa5bbd82b591ec1d94bcb21
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+Txsdo:8o/CKJsGWDMCqo
- TLSH T15D056C1DFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 826KB
- SHA256 7d7868ea0e80361fecc329d84c2051aec5dee259ceae8aa5f9d9816e72c00ed0
- MD5 a3a16b1687768d35f20675952d8a33db
- SHA1 512fce6f99da26bed9d608a57bf9a3a55c5baaf1
- SHA512 c6a48a338901c79eb204fb733bab79752f3f4e34d2e92c8138aa9eff5a3de301687257b021e23de571434da4ff15e7262d4756f1c2d4f776f64db5367d163649
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+Txao+:8o/CKJsGWDMCB+
- TLSH T1F1056B1CFEA48FBDD9520634C466C76E6275BE204812E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 826KB
- SHA256 6290eb7070ceea7344ee0221b35694a0addb98cc99a59c60f84875b2e75761b6
- MD5 297a33c68c8ed14a1be8e165fe5ebf8f
- SHA1 7e47e0bf963b12abe5992db2af1a74586e3caa3b
- SHA512 826f53f5a8523e25e441d4f0a2d6b0a301316e5bd05a489fd5a17c7206e592b98c9ac270fc7494206dc59f02fc00718cef23278d7a4154be85b2e7966858ae5d
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxGcQ:8o/CKJsGWDMCPQ
- TLSH T155056C1CFEA48FBDE9520634C466C76E6275BE204812E91B339CB60EF970F42752E653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 826KB
- SHA256 e8bdbd675ff4822ee24b6e4c3571acc0ebc9347716660df2c7ab5f2aa12ba6bd
- MD5 01e0c3c51944cf74dd6198d8a8f248b5
- SHA1 13e6458b94a689999b5346e4beeba8ec09136ea7
- SHA512 5784bcd6d0eb38cfd70cf1ee1e6026aefb12dfcd68ce58160d807e61c92a3aa992eb2d890c07d73310a4f04586aedeb5e68f66e98d3296c3c508236eaec56763
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxQDX:8o/CKJsGWDMCUX
- TLSH T151056C1CFEA48FBDD9520634C466C76E6275BE204812E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 826KB
- SHA256 09778b811e9a74edf0f40a5bfd7eb6f8632398a11504b4263c15f703eba90f93
- MD5 f0965e0b9e3fcfeb8cef0a2309559a03
- SHA1 4207a81bbdc6e6d1c796e17b74e125f525bf6aed
- SHA512 8d44b9fb0ba299e5d9dace475a64b08bf7aeb1dcae60f4f10edd4cd093aef88ad204efb765810a7166e8c629e6684949b27d9799919a94f6914776e0aa9395de
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxbeL:8o/CKJsGWDMCyL
- TLSH T10B056B1DFEA48FBDD9520634C466C72E6275BE204802E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 826KB
- SHA256 0158587083716d991eb5da9f355b309908b273400ffda97a66fa705a450684dc
- MD5 640b2ecc0a3284cd76652c83ff04598a
- SHA1 5bbd9ba98e1b90663580338a8d537d7e473a9cb7
- SHA512 1447607440d7d0f3aba210c93e44438abe0901a0eb73833b89e983743db8992b7bd8ba8e9c219db891993b65b66f1fab859b5ce2c96d4aaa356249f0166446d3
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+TxVoFC:8o/CKJsGWDMCWFC
- TLSH T18C056C1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 826KB
- SHA256 2f2a5c29d28db1311db148639aa4a7cf16e49d4a3e24da5dae6ddfd7833f4da8
- MD5 912c5231117c6e109b3e659486854d83
- SHA1 90b2ae7e1a8d435feef766b0132db88147a4e2ac
- SHA512 43f43947a26e9f70018ef322ee5687fdfd02ca22241e760f247e38517ab364d46b6a9b723f967ca1fac5f3f78244143b4bfca4c588b70e4f880de01c8c2c550d
- SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+Tx9Rh:8o/CKJsGWDMCfh
- TLSH T1C6056B1CFEA48FBDD9520634C466C76E6275BE204812E91B339CB60EF970F42752E663
- MD5 SHA1 SHA512 SSDEEP TLSH