482bb352041924596fcbd2a5a61aa2f44d6af8dd4b49d6ee20d785ddb1d0e9c3

Analysis

max time kernel
101s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
Size 765KB
Sample260804-2walqasdnd
SHA256 482bb352041924596fcbd2a5a61aa2f44d6af8dd4b49d6ee20d785ddb1d0e9c3
MD5 5f78b9e86bc20e2e2a477fb8a831afbf
SHA1 9c1296fec6cf12de9c2efd21852c4a777eeb9100
SHA512 c990fdcf04ade6906b62953f311a9a0227f91103105530840b87351cc7ed53f972674bc0cbe66952e0fc490601ddd5a395635be5ab87409062be075f10400b57
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSsCjvp:KIifqFu1//IifqFuyDA54GX79lSsCjvp
TLSH
T1AFF48E07F6A244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/1328-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5de-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fe-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-348.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-469.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-494.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-573.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-616.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-635.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-720.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-739.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-782.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-819.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-850.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-863.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-882.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-889.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-902.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-915.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-928.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1002.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1039.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1058.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1089.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1132.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1170.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1177.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1214.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1317.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1330.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1349.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1328-2005-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2472-2012-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
2472	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe

Drops file in Windows directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1328	2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
2472	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1328

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 765KB
SHA256 482bb352041924596fcbd2a5a61aa2f44d6af8dd4b49d6ee20d785ddb1d0e9c3
MD5 5f78b9e86bc20e2e2a477fb8a831afbf
SHA1 9c1296fec6cf12de9c2efd21852c4a777eeb9100
SHA512 c990fdcf04ade6906b62953f311a9a0227f91103105530840b87351cc7ed53f972674bc0cbe66952e0fc490601ddd5a395635be5ab87409062be075f10400b57
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSsCjvp:KIifqFu1//IifqFuyDA54GX79lSsCjvp
TLSH
T1AFF48E07F6A244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 54e6754a276ed825f3a26eff8f1579bd3ff32a98549d756e0c4539e50d31e8ab
MD5 248ae9f86240015e42e6c50b109b477e
SHA1 301b1222e5e37171d3e81b3600b992fe4e789c7d
SHA512 9bdd7b0077c32c33148311009d8eafbc8b3c1d477f593dc250a7f76e46dbe59fd1c47619e9ea30c1c0724a67ec49080ec9ffc3533ca6639810a9e2b7eebf9354
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvV0Le5ji0hmxNrM:WqFgqFUHGPji0Aj
TLSH
T199556A16F6B04679D023C075C5E2A3B6EA71784217309BDF1399D7382F23BE59A3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 780KB
SHA256 f25c9a08aa1e5884458fa2931f85c80866c7ede4e75f02f2d585d78c78657667
MD5 f01c669ceb0a77a390de2789fe5d5403
SHA1 a2d8ab2907cab2e913dcd845657190cf0a8f6a1a
SHA512 376805cc573c129aa709c5e2c3f54e7c24501c925c40077719e9d382623bdeba0ee7db97166ea1fc8e19705f361d8757199ac3a66dbe1e44083130bc6af76843
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjv3a:WqFgqFUH
TLSH
T170059E07E6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F20F906F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 789KB
SHA256 7872e926aab09f868c384490878b4ac26931919a459d026ecab83bfa5ee99cc5
MD5 0dd10a8f11f5bfd1b5c8f473d87f9400
SHA1 cbf0d30b15a7f2dbfa2b682a175a63364fbe3e78
SHA512 eeb260c24e525c6c461011d3c0e5c755cfe0e9a3b9fd79f7dabae804d365f4a42858ab92cbeb949377fe6c4c6fc35b718177b284c5af8065f6ffc09fca7aa0a7
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjv26:WqFgqFUHw
TLSH
T19A058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 789KB
SHA256 a3e430be34172082849c40b3d6ab69025401e4e7df6631217578cecb55c8de87
MD5 506dbef3515fc15a53263bab3cb6df92
SHA1 d0ba53b35af8bdfda07fd96981c59fadea03b4ff
SHA512 761242eab7fb68024e7716442c0445af0c732a49bb94cff5305c443995847d1573fba45332460df7e189df1a4bb32173fc224e98cbf451a199d364106f1e33f1
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvmN:WqFgqFUHt
TLSH
T166058E07E6E244FCD517C17089E69372EE71FC225620A7BF2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 789KB
SHA256 e53a6982e3e2b2a2d1253564e315b5ffb1d4100193806e8d7246cec2397252de
MD5 fc4a46b28ce9a31cec254012b87d3629
SHA1 8a50a104bf323db36101986d3156a18befaae8a6
SHA512 34570a669acddbca2e287a42434c14d217f0a12f62fd1d43237822ca6c759cc22414e0375bb93d2ac8db4c7ec70de5dae8f05c6c884a57f862318a4f6084e7b1
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvkf:WqFgqFUHF
TLSH
T133058E07E6E244FCD517C17089E69372EE71FC225620A7BF2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 927KB
SHA256 ef6230269099830a9d4b18e2bdfe89045b8c3d84f8b70b389b6b168df3682b9d
MD5 2476e8385d03b2b8c8406d199fd95741
SHA1 f4ee2bd4db30026d573373dc3838eb87936ec1ed
SHA512 01348d7d4777d5b22799ef4b8e62f6efecfd7b47947906df5c5996eada8ea89727a3299debc088818053792814c35ab8d50bc1b442938bf144f1686a5fefa08b
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvPzy7:WqFgqFUHgs
TLSH
T1BC157E07F6A214FCD517813089E65372EB71FC225720ABAF2758E6352F21B906F3A764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 789KB
SHA256 bd38f8653454717c7e0e02cfa35e04d4c67f037216ada0977575f7e3a51a9bc1
MD5 994465e3a9c32ff3ebdc81b0430fc06f
SHA1 e704cccb560d26f1afbb2cc8c6e77bfd3178c192
SHA512 dd1780ba9545683ad8d68d4091a70dbed57df681e65cd8f994ea8092fbe64db83b7809ef574981fe5e31dcb14956f7fc541fe08c66cab4844392143b83a60426
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvOo:WqFgqFUHQ
TLSH
T1AC058E07E6E244FCD517C17089E69372EE71FC225620A7BF2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 789KB
SHA256 291f1f7c565f7e9c77721edaedcb1a4d42f4b3a2b9f127db8a3db90833f69e41
MD5 ed6aa39c72eea96ea2b2dae120c69998
SHA1 98c10cb7888a6c83c68fe2b89832380298222f0a
SHA512 e4caa5fa67fb310bb753a787d6b12b491ad42815599c2fd15fda5532ed06bc42e9ba647601bcb12ef7208ee9b64f2e08ffa90b482d2144296e1b941acf8fb5e3
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjviu:WqFgqFUHS
TLSH
T1B1058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 927KB
SHA256 c543b6c80c5d2bc5926f336a8953d6130a612878d2186f0cd20c147261362af8
MD5 e7233aecb5792f49b62f7b8db9575e42
SHA1 3f08e69b8625eea117077a4c7ad8b544087597b7
SHA512 305ee155d5ff003e975e4bc14f6450b728bf0623ce21f12879bd7a3f4c83e93894bdd0c5402624294acf63c8ca1f97a60db2dce512dfff21ead5daf28d8e01bc
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvCzy8:WqFgqFUHxT
TLSH
T132158E07F6A214FCD517813089E65372EB71FC225720ABAF2758E6352F21B906F3A764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 789KB
SHA256 a4269b36041f5c16d200c875db56bb9ac97bb6d80afbdf297ebcfd53edea0e70
MD5 cde9cd0525d0662934f9ffda202ef2e1
SHA1 15387b3caadab59fce16d8a32e72e1f8e2630f5b
SHA512 2ef3536b6cbb6207953975c804a210d20022c2bb8c817142553ea6212f66bad5a197f47c6dbff5d57dd7e983d81e5d09755e93f1183f93dfb193278e31b8bfc3
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjv29:WqFgqFUHT
TLSH
T10E058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 789KB
SHA256 03596de6bdc03a0b0e996a15bacb472c7015a0391368d5a0f29b3683bb4bece5
MD5 ad772f14d3549d2c6ba3e3457fd3156b
SHA1 a3d0763b39e3ce13795a0afd4f02d932dff91f41
SHA512 db31e1df7ec1eb742185cbcbd3b5eb32b264149bc490082f075cefba9cf092df0bf1e4c09e8a2dfc60a55e55ad14bd98782d7e31d7a8715920745e317a3de0a2
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjv2c:WqFgqFUH6
TLSH
T116058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 789KB
SHA256 2a44a398cb3ce314f126f28e90599cbc323c3eafd2b344376f152c2a17b1922b
MD5 0b17d3c708795644a14094573ec77afd
SHA1 962d180cdb2486dc77221d43847437842f4fd4b4
SHA512 2374d9d2c9e2a9703adcd2926c40a045a6215ceb9d01236060a5d33724e03a7d01716c11637a2ede8a11ebe8e7b7f0edef0cda1e4fa60fdceeeb89a5a26367b2
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvvp:WqFgqFUHg
TLSH
T10C058E07E6E244FCD517C17089E69372EE71FC225620A7BF2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 789KB
SHA256 3f04c45d7037caa532163a7796040be002a1b9b870dedbe476f3872c41219dfb
MD5 f87fe1345bf64be55005cdf786bc9700
SHA1 42aa0a1bc96c8415afd92dc2c4af23aab0798a80
SHA512 082f0fb82be78519174879b7ca836de4c4c0d0c8cba9d9f272741e0ce3a9a9cc01a31ab65e3d99db6c32921e768f72ebe89e6f8918e7fdae412939f0ce1d62dc
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvQN:WqFgqFUHf
TLSH
T18A058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 789KB
SHA256 3f9c8b80234676386392d67f601171a2c4c43f41fb96f4e80ef123a4c3d0c58d
MD5 26201c09a4f18f4603edd77e3dc9560f
SHA1 ebaa565a5c1c52351d76b2f123655cb894fdbbf1
SHA512 2225104fad8cf72d2a12f119b06f6dd00065cbecda072e1b5e0e352a683b56d9337fcc30ef7510ab9204c5f05ca520f6a5e08cdc33da927d41520e4e190d0cdb
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvYF:WqFgqFUH5
TLSH
T16A058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 789KB
SHA256 a06af11c965bd095c1549eab1a44615f6183b079dab8f28ffbcc6489bfdd5ffd
MD5 a66913f0007a5ca32a9c56141d28cc64
SHA1 3e30312a78f2ec0814f79ff02ab1318c59490414
SHA512 790c84af056156ca8785c683e881813f4d70babd7e9d627a5d4d50e8ffe9e4dc7f3255f897e4c8a7e5ddaf6b8acacffc4084d6c8347009b7ccabd9742c807bf2
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvNC:WqFgqFUHF
TLSH
T12D058E07E6E244FCD517C17089E69372EE71FC225620A7BF2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 789KB
SHA256 ee335897027e41d32ce67cdc2984713a4774dd35fbd77c84fa908a925f79bd8a
MD5 33d3f0041c8db6405d0ae621ddb0e314
SHA1 8297a955f138f170708649231410bb530af50517
SHA512 c584baf6ca39834c47aeaee6f72daac8aa54fe8edbf9dce465cf39360b55e1a20428f020c93cfd9fe8f53f1ad50d99360c43e9d7d7854e29bebab954623309d5
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjv2w:WqFgqFUHo
TLSH
T11A058E07E6A244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 789KB
SHA256 f4426668ce108853dc04ff394ddea3f6440dfc39b1009fe3f9020da432aa345f
MD5 2a8aa695ccd8a4efddcecfd26887f71f
SHA1 2076e9f134b0ebf65d792f5248639372da3cc5a6
SHA512 4394f39407f622d61b9a29e20393cb2291ec5bf49f2d097ea992fcc5ad118b44e3dcdfa883ed292959edec9ae6214a68b1f200696944865aa96eb4aaf10fa9c6
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvlT:WqFgqFUHg
TLSH
T19F058E07E6E244FCD517C17089E69372EE71FC225620A7BF2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 789KB
SHA256 ca9e61ad883db9e6a5ce0c03d5e4cac664c9fbad9fd734d8dfab28b06e4f6589
MD5 06cdf61c7a68cf6a8cdbccbc48c51341
SHA1 7b7f45662360c101c0850ea774881296150a1653
SHA512 61cec595028ccc74c18b4f9357fe11c9acce1ff752ecd933acb1c5aa65deb63e1077cf0e734a2bde7f4d5e351f43fb1494a655a0a3e82814fcb1cffe854f415f
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjv7u:WqFgqFUHf
TLSH
T1A3058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 789KB
SHA256 73d6e868c56ade0df4bd64a6eb9b1fb472028e29c63a5ea12de9b6555080a67e
MD5 d62da86258be0386bad9facda66986c6
SHA1 cdbc787438ee6707f063baa683aa2024741a88c8
SHA512 0399e071866a65ed28a60d4768ac3e551d45cc2f0ed8efb15c8a8c6e6346e290d21a58c09f63e4005acad70e2427a2332ad3d165b943a345a7619acdf296dd55
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvfb:WqFgqFUHG
TLSH
T181058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 789KB
SHA256 932c17beb61ac5e136a74d3ca353740b50b7dd62547c915dcb67870dab4c4033
MD5 cb418f4a8581b27baa7b8feddcd8aae1
SHA1 69524c39bb5bd8ccf22ca2b170960821bc046706
SHA512 66bd1fb9bc6f96919051a089525ac103c349cee6e6eaaa6bce595940f9794b78c18fcefc0b78f0df47a859d541481c097824e964da2ff93de1ff4614ed649257
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvbf:WqFgqFUHW
TLSH
T117058E07E6E244FCD517C17089E69372EE71FC225620A7BF2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 789KB
SHA256 2f2dff4e55239c7187f4323240fecfd7f8682ed42a9973581a140f7e9ced071f
MD5 e730e90f19ced6e288e625a10eaacca2
SHA1 79d7f37a1a795d19b60dd1ca120a3bb8f311d9dc
SHA512 0c71cbe9a92e420360ed9acca741d0e6e2d69fa023d6b37e2fc6f3800de03fdf7bff95ec8d33c61c056f1a61ec8361ced4eb5be31a111264cec1a53d7d29fc1e
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjv0K:WqFgqFUH2
TLSH
T1C7058E07E6A244FCD517C17089E69372EE71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 789KB
SHA256 7152ce2fd0745df4dba798f18d1849696fcb3b28197752da703d72691b9aaa3a
MD5 a1cd498dddcd85106453d1e0d0bd6690
SHA1 77f9f0f3c553cb3a1340abaaf5e4dbb4824ce3bf
SHA512 305b2bb2a374598ab250c0d60ae6525cea6903e78090ab4b07ba06657ba323ad69aa554fac6955055e66e54774619c935eddac1a1c8b290e8be7d6ce9256989e
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvpk:WqFgqFUHr
TLSH
T14E058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 789KB
SHA256 2f4fe2bfce45e8904f9dff47df72a22895bd2463f69c852b355a3750817d6dce
MD5 08135c5c1ab38e70db27337259b8f698
SHA1 7c07c11f642cd1b2777ace9288dd7e39f6a6c842
SHA512 c51f8efd15be90460cd9e83330f9f275a5936f9a5242467c9af9671b4b0e8d2d95110a04de30003806708c16fc80bc5b5b76126313bae9caae1774e134f486fa
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvG0:WqFgqFUH6
TLSH
T195058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 789KB
SHA256 e36708888d769e661ec8c9a0f0ccfd5b9c85ee395a5e5344f42aee393fc5311e
MD5 ba00053a75afc3caf148cd6fef61a517
SHA1 ae5264387ee23a500960afe784cae2d601b1f9d5
SHA512 0556fd058de73410e6982b3f4d2618f6e51e0776600b6b90725d0041daeedd056ee2000fa75dc6c961e5bd2cd06daa68d09cfadba41fc8b1594b2b93c23c3df1
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvVg:WqFgqFUHD
TLSH
T12E058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 789KB
SHA256 e54a4dd8a76aa0b20f554f3950e910c0f58b2d4461318c3150a3b7a20b596585
MD5 990c2d619da6bb7be9e85341b3bf49fd
SHA1 021ca05a96dd20032f8363a430a47e38f6740578
SHA512 92df688e88bd0356b2fb45bf77d4712855e5b688111c3f390aff4c8bb985be4fe2e5808533b9fc4808b441041dcbe8ba011a55c129679eb3249815a6286579ac
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvkr:WqFgqFUHV
TLSH
T163058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 789KB
SHA256 3942a42118b9f4315a9b7e6921192f240ccdf6dad7ace8883b8de7b4fb45f0fc
MD5 4f6777721d7fd6852541da92509020ee
SHA1 9bfc380dd211886781cc97a3b9169040a7a66ade
SHA512 e083480363919388a6a8c6e0a66604334b5ad245c9d2e313dabaa11590cb3a91600aa98c8eb4113cc8ed3ac2a9101f432363a15705aaa9e8faf3682402b07163
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjv6n:WqFgqFUHH
TLSH
T1C7058E07E6A244FCD517C17089E69372EE71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 789KB
SHA256 62ec56fce6595c10685415f1fd577e12b7627e1481ffd74c3b3a6b8666efd986
MD5 869b50d2c472079b69b0f3310c7804d6
SHA1 af187c0ab68b07c52533983f3433ba5110725d8e
SHA512 56acc8dde888266b247adad5f3fa5ca2267ef7263050d09ed16e563b75fc85a25b503594cf7dee25ed49a6cf231fc9f4ac087ffbbbde0dbe99d48da431e2e72d
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvQx:WqFgqFUHd
TLSH
T1F0058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 789KB
SHA256 07e589531ae754f09489a1d48858dc272ef96b667dfcea93dc0c5bdef2ef4479
MD5 951959a978c6794976bf72927aacdba3
SHA1 0f5f167c94312c7be6e9fd69dcac58439d457582
SHA512 122c5f1e35e6ec8759e6253dae4258e6f856609d2943c399c521dd00cb723a9ac4fb252d9d75d170be4fcdb178f477e52f2af9dcab5dbe193b661283bea35f24
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvSA:WqFgqFUHC
TLSH
T1A0058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 789KB
SHA256 ef3a6d9268e23fa67269582c2e5f14131e7cb4b10a9de7b45bee9d5910773bf5
MD5 6046ed625c8a8e12392cb58b716aeda8
SHA1 8f3430a54925625acefbd2873fc78e97b6ab6630
SHA512 1aa2db3c229002f49b2f25d110d771d98f02a9ebd35634844f204007119c34fd24225dae40372070148c4b46ed08692d8337320e5329dbcb9c78ac533b5de9be
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvr9Q:WqFgqFUHf
TLSH
T1AB058E07E6E244FCD517C17089E69372EE71FC225620A7BF2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 789KB
SHA256 4f5c252530acc3aa6f5e5548a5d163c5cb4c9a2418ef527fc6e72d124fa0b29e
MD5 5ad28e66015ef309f79fd4c4defaa26c
SHA1 e21b4ea64e8d4e038f5ef728b25a8fe1d429f783
SHA512 c58ee76dedbc18d4353f07ef52901ae2296619b8ecd358aee94abb132128f9c1893bfb3324dfdc24dbef8ed832b9e15c940bc159866a48e90d633b8f08526706
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjva4:WqFgqFUHg
TLSH
T142058E07E6E244FCD517C17089E69372EE71FC225620A7BF2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 789KB
SHA256 111d152ddfee51ee214a61b58851bf5b02d4310e560c81c472d56a9c88158263
MD5 0b7f05f1243948b0b9f9e698342f098a
SHA1 cd8d358704e297c87b2a3db603ef7ef00c575d6e
SHA512 de47403e957b2c385447d09949149a4c32ce574afccd03f97637e6a5ce1accd8c3f8d53032aa88a3adfbcb5d8eadbb7da85422597171d24d00b76d8afd5abf31
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvBu:WqFgqFUHB
TLSH
T1B0058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 789KB
SHA256 91493d60987188304fbafa09df1a5d3e99174b0cec322a22c8c812aab6ea22bf
MD5 5c402d5b16a6b13fa43819ee82f6f645
SHA1 db53add3683466e9a7bcd260b0a13523a5b16617
SHA512 1518064acb82c66b3781262b55e4d3458ee03cf216e6f20278f4178d85d3bd40295f32dff6c772b6374c8723fd5e867d099f4d795220368e383ececde13c968c
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjv0j:WqFgqFUHr
TLSH
T1E0058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 789KB
SHA256 df45b8a46b0c3169f02613c68f2981b0154a956c1856fdc7506017181bcd25f1
MD5 74fdc48ff0dc655935764233be8cebbe
SHA1 062f08e33cf3460a98d6337d715882b06c70a459
SHA512 6d2815b41aca5f23025975d7658fd029851210c6a8d4223e79e2b427aae2b25351626149899279f6a04c27a93beb18f9a0e3644755ccf9e120cf6a45b556d678
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjv1g:WqFgqFUHj
TLSH
T1E1058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 789KB
SHA256 c582b31fff7474e6c0f895db14d4efeaebf088d2536250f2f96f65c395ec06ad
MD5 11ca02a34f0190e77a36d0c77dbc6a45
SHA1 f00d5f5fe69bb8bb83ac357852906b70c0eacab9
SHA512 b88be90b80442f12e47a41ffa68567deb921937a43e74b38daf2b18e29ba1daa0f6987c0c7e6fe57043e33946b8775c9aa0e79e6e53b8d982c6d3b5c4cf934a5
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjv0I:WqFgqFUHq
TLSH
T1AC058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 789KB
SHA256 68c21f56ffc2395126a5c3092d415dfc874a87ee04440e6b36de26d403c08c7c
MD5 b1a3b363986737d6c1463b87c011489b
SHA1 dee661f80f9f748c9fa0cf20e40ad632ec5ec8e2
SHA512 2f66426079466d39af9c366b3bd6a1179f87726c32b2f0c981b62e9e5c25b816f0ebf4853f5fe32c80a5baaa536068f3ba2a535711a8202187da551ec4229197
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvmo:WqFgqFUH4
TLSH
T1CE058E07E6E244FCD517C17089E69372EE71FC225620A7BF2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 789KB
SHA256 b80f97864be6b3469b1bdf9786438a45286234a6bcb5cde32a1e87deb2b9e33b
MD5 f5212419e4fea635c30fea324d583848
SHA1 42b02deee2b2526501b35da7f8a9bb34aa19fc42
SHA512 6f784e570763e057132302c1ca50ca1a7ac943b6586384632027733141c190bc6f7a9997f4bc810923cf713d6c4c4bc645a48a8fbda45533a12fed97d64089a0
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvN+:WqFgqFUHF
TLSH
T118058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 789KB
SHA256 af0b700d05d06aaef4334535c774193097e97b0f10285730af39ac33d6201637
MD5 957a3c688b20f83f175c189745391026
SHA1 47fb757688856bd8eec42e7797e1e08c9fc0a8f5
SHA512 432958149168e9d9a5310335a80d9f47a531dd10af4bcc5b67133fc732f9cbbdb226f5d613fc19c78f86641b512ec311aac742762aaa396f78ff30affa25c865
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjv7Q:WqFgqFUHN
TLSH
T199058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 789KB
SHA256 7dec281c6b795ad3611a2bc680268f3177f2f69a519bae92669f9d428fec8617
MD5 88d6ad0b47df8cc72fc56dc3352ea580
SHA1 aed6a748b9b148b5b169794754feb0e3b2fa64a0
SHA512 f5e1491bc66c2486e7016cddc2d834a1f9b4105c7395614581caa448bb95479a88550cece4b320693f20306f5d18c78dd35a1867f79ace5c93d7a42ab27e6d9e
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvwX:WqFgqFUH5
TLSH
T1FB058E07E6E244FCD517C17089E69372EE71FC225620A7BF2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 789KB
SHA256 74166837b4d8afb16eefb82d90557489837938fac373d80b285ca51bdd84f39b
MD5 d5ba2f711410ceac63475f8ff0a608b3
SHA1 427bfd32928453c300c6302bd5b982708e1bab65
SHA512 375decb65c1a9d9e76cc4983ec8e92f506eea93046de41bc8f326575f0b4fdee63d5f3851cc498052806909a623820527b2e4814ca62b251a757906cdaa3ea85
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvGL:WqFgqFUHz
TLSH
T130058E07E6A244FCD517C17089E69372EE71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 789KB
SHA256 756b0bc5c9451632366b94da536c37d31b1294e666381a2761f398e0fe6469d8
MD5 2581e25d5642b61b28ce5ca115c2394a
SHA1 5e54dba095467f4a4a4680e95fcf0c44fa1b8067
SHA512 180cb62aab2ea952280113a355e29115f5d361b14a80b787f1c1e591c8c077c9b6a666d990f2d53b9732239811af10ce50f9722732b511604e68644637a430df
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvaM:WqFgqFUH+
TLSH
T1CC058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 789KB
SHA256 19c5ba1040ae0c422a38df52c0a548e76a605a978762557d38d96958a1445eb6
MD5 e47cb7da2f7dc3ff70a917ffc04fa5b7
SHA1 ad4aa55275d64cef62ea0f20af0ef876faa9c5f1
SHA512 f8d4441d97a38fe82e8970fd138412c4e5dac1ca4a3a440925644fa4ee1e8b16fa06d6fedf67b884082b0dfc6143ad6e4ebadb5dcd41ad5181b0843ca9efb608
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjvLh:WqFgqFUHQ
TLSH
T12A058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1328-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1328-2005-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2472-2012-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads