57724dd8f845cf0e6225ac6e586779a805521504e0096fd2b430f513fa90835b

Analysis

max time kernel
101s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
Size 791KB
Sample260804-mvm34atxbx
SHA256 57724dd8f845cf0e6225ac6e586779a805521504e0096fd2b430f513fa90835b
MD5 92f0d6a3749556effdf46900abe9b5d6
SHA1 cc35d3ebfeac44a3ce7c695324dfabcc9ac1f344
SHA512 759fc557a8356132893e92b9d6b4ade1fd507f43de562537746b59489d9f5e3a03c204b2f5b74505fba630bf8125f97d620b3d4e05c5a9429cf04f57f5f11e61
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSsZrZ1IyS:KIifqFu1//IifqFuyDA54GX79lSs1Zuj
TLSH
T131057C06F6A244FCC557813089E69372EB71FC225720ABAF1768E6252F21FD06F3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/400-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5f4-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e5-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019840-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-408.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-481.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-506.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-591.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0014000000018a52-622.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-713.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-732.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-757.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-788.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-837.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-850.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-882.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-889.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-902.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-921.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-946.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-971.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1002.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1045.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1076.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1125.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1144.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1169.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1189.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1214.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1356.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/400-2011-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6096-2012-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
6096	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
400	2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
6096	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_92f0d6a3749556effdf46900abe9b5d6_cobalt-strike_conti_elex_hijackloader.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:400

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 791KB
SHA256 57724dd8f845cf0e6225ac6e586779a805521504e0096fd2b430f513fa90835b
MD5 92f0d6a3749556effdf46900abe9b5d6
SHA1 cc35d3ebfeac44a3ce7c695324dfabcc9ac1f344
SHA512 759fc557a8356132893e92b9d6b4ade1fd507f43de562537746b59489d9f5e3a03c204b2f5b74505fba630bf8125f97d620b3d4e05c5a9429cf04f57f5f11e61
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSsZrZ1IyS:KIifqFu1//IifqFuyDA54GX79lSs1Zuj
TLSH
T131057C06F6A244FCC557813089E69372EB71FC225720ABAF1768E6252F21FD06F3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 ad9663cbc8b0f243e0201e5a030ffcaa28ebe20a4f705a0b8eb6e108a808bfce
MD5 55343226d954945b1d2b8d3321843801
SHA1 5ca96d37969de1f578188db5aa8aaf45771de150
SHA512 33bd34dc6a29b4a73cdbe6ea0cef8d25764eb8031c99c41983c7514fa738bb3843347939b4b7807177e21af9778e966639c65487e0d4c0a7e4fae857b2957656
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1Zuf0Le5ji0hmxNrM:WqFgqFUHIPji0Aj
TLSH
T13A556B16F6B442B9D063C074C5E2A3B6EA71784217309BDF1395D7382F23BE59A3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 806KB
SHA256 5ee374160ceb0855442790804db535690c3b15e8f435c950490bb5cc8dba7f0f
MD5 ba89d2f067e6f79332f25f15eb242778
SHA1 ee13b954ec98e72dfc6498a1288b50edc7cd16e9
SHA512 2e89402a376d590ef679663916fd1acf858eb0e43697ac4c48fdc5ae89942d59b35dbc0f097fa9936ddc580ccda7c34629ce7fdbfeee9fb9dc0d88b85472afd5
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZuBa:WqFgqFUH
TLSH
T185057D07E6A244FCD557813089E69372EB71FC225720ABAF1368E6252F21FD06F3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 815KB
SHA256 a5b117bd33dda4c61e37e9399acd9f811e7101ec4a4378a3774b4bf70a933a77
MD5 5b785b6ec056dc2bebd047c6e1bcca3c
SHA1 fedbb2472525b83a4af194952ef356e31aaf0f5f
SHA512 043a0e21c8e6d6001aa55ce57a6711dfb21b8a29d8bc174caae289786e6aeb9033bb71cde3fc4f0d3a3fabb15e36dd1e0c4af38a72b4e110b517eb47237013f0
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1Zu46:WqFgqFUH2
TLSH
T1BF057C07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 815KB
SHA256 a19fa33c26d6c92df0d33036ab05638d8d6bd4509b775201160b15b76db734bd
MD5 4eea03e006fb6ed24e1dca94d6fd0b4a
SHA1 bf6bf4d093e7495fbea29878765222e80c8cf802
SHA512 8e7e6cc473c51e52160732529706d7405b87dcea1c45c04b3c73eb33e243771060b17c028cf0b9f3fba4e175ee44aad0bfc5b02a0e013034c381a778ac6acb7a
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZucN:WqFgqFUHH
TLSH
T14E058D07E6A244FCD557813089E69372EB71FC225720A7AF2368E6252F21FD06F3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 815KB
SHA256 751c897d79cfb15224d645973a98f22237b3f22bac1dd4882ff6c8d0bad7240a
MD5 56e7b10d5e98ceed5a3e016dd33fd1b7
SHA1 ae1782348a0c9b31566753f76716fecbab1978b2
SHA512 0b40383d91fc046ac9e0d12df2a62096f5c52229d4e9f68cb7d426c65125fd209d1899e3fe6d6ba69f4e6eab18be4c0eb96b0a55ba572e952d1597c75824a1c2
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZuSf:WqFgqFUHj
TLSH
T182058C07E6A244FCC557813089E69372EB71FC225720A7AF2368E6252F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 953KB
SHA256 7be9ae4ba1150f49b420d20c003a97efd3a0ab2c1ca9c59aae7609c2017e3f03
MD5 a8afc9f98f7bf7d600f0b1a6b7f4cf65
SHA1 6ea1f34517f24a3594d19eee986f278749f11aee
SHA512 b1e364fd4b0734f86d7bbafd1e92f0c64ac932a689ebbd42cf89dc6ed793b4205362d65edd8270517bfa9a6ae70ba034ed9e40cae6b526e9f0e8c0f0fe236a74
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZuRzy7:WqFgqFUH6s
TLSH
T119257D07F2A210FCD557813489E65772EB71BC225730ABAF1368E6352F21BD06E3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 815KB
SHA256 a2c53016b8dead62ef48f4a515e5ee24aab8577f0be7d979a996e05aebc0e785
MD5 0a7ec17baa5a13b3f49a57de44bfb88d
SHA1 87d860895b0389799c17a49da2c45c4ee1dbacbf
SHA512 f5fc3b7f878cf260796f23d2aafa6cf4eb331e407ac8fa3f7937f13ee5c5108759c4ce58dfb0f43d7511cc088f877243ce41c98e5f7de85e50727b63642c9ece
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1Zuso:WqFgqFUHS
TLSH
T1DB058D07E6A244FCD557813089E69372EB71FC225720A7AF2368E6252F21FD06F3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 815KB
SHA256 a329c5fce1ddae4f7ff62007858b27e54d5b9759a494f59b7c1796edf778ab1d
MD5 eb9ecc88a3b7f90abb55054afcb50f7f
SHA1 cc042346b5f40b6746bb0c2fba2924d44c71c2b7
SHA512 e751815f29e283be4f94c2289676a41ddd85a8af5e83d61a4b4c107d2a9faa35d476f77c8ef90d185ca79a976aaa0c208a474c199e43d9671e502972050ab5ac
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZuMu:WqFgqFUH8
TLSH
T197058D07E6A244FCD557813089E69372EB71FC225720A7AF2368E6252F21FD06F3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 953KB
SHA256 b8570b245215544da56a578996f29739c1139b429775611346f1ae359f5ac86c
MD5 29f8ff8e46c9d840ba15400fbad1ee52
SHA1 2e2397a0c6741e0ce9a2e8a2a98dce1a70514206
SHA512 9fe0ab3b757bb50a8ca028676aa7f67744baa940404dfcf26e4a82864b21beba5494cad2b84942b68b8bcdaff0fd17d003490fd60d6fb6063c88fe594a1158b9
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZuAzy8:WqFgqFUHHT
TLSH
T17A257D07F2A210FCD557813489E65772EB71BC225730ABAF1368E6352F21BD06E3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 815KB
SHA256 28606a2cd80324ac91ef7188e6f8198e026f279c00491826400b3b4e8ab1e379
MD5 f61a59fe43c8564833b2cf285df48baa
SHA1 0dc37bbb8ebb49b1245938bef23bf0d027aa70ed
SHA512 b4e862c7756ffdbe42ba860708b174ab4e3442fafe0659ce7fa6cc313ebfbf30aeb03ac988b9ebb96e9752749e05e598c1e38ca7de2e27f3d886984a655b3ff0
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZuQ9:WqFgqFUHh
TLSH
T17F057D07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 815KB
SHA256 0b0269d7f568ed2d8917482c8f7e77f6d031bcbd0f09844fe8fb52ba835e7d3b
MD5 92daa1a83ddd3b7336d1cf137b10e99e
SHA1 19e9d7c73bb7aa2582501afd617596104ed7b48d
SHA512 1e96791ac85f23109fdeeb48181968271fbbbee1694920c69d1d4b901a7cb218b10d6896903e2fa78dca01c7a32d7bc70d491004a713f3a0637fef3ffda9e1ed
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZuYc:WqFgqFUH0
TLSH
T12A057D06E6A244FCD557813089E69372EB71FC225730A7AF2368E6252F21FD06F3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 815KB
SHA256 8c8c2df9556b62e2e2af31ec271803c36d1cad8fabef3d2abe1f8fdccbc9b5ae
MD5 5becf5c200b7b485dd2c67a3dc7b4cf6
SHA1 0fab1a73e34e1d5cfae8b2794b72510413c2d821
SHA512 0988d098d8043bbaa787f0dc8c24e515f48e83a41d155b7aff349043a81460a5de5a58eb9f1e55751d13392a9b9acd86e2a0c483f934e0fb4f8529889ee0537b
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1Zuxp:WqFgqFUHi
TLSH
T136057C07E6A244FCC557813089E69372EB71FC225720A7AF2368E6252F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 815KB
SHA256 fc7117025d91b6523d6a0be58997d7d05222d208990496627ca0635708491998
MD5 93d384b731f0d118cc61ecd7c3eeb4a9
SHA1 60b112ad919309d1a17a0b392754dd91fe7e12f9
SHA512 87e85854a57b8a7de39ae8ab245486147e166b6575c92177c96fb4bcbca2a23fb270bbf5cfee9f782d1e0acc3fb78d2693f77a2e6c41af3fa7fca4626e78c534
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZuGN:WqFgqFUHF
TLSH
T1E0058D07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 815KB
SHA256 c6e390b206d6a7c958ac9bede23ea81b6deda2293cc907e82b8f8420e9b76e7f
MD5 711c4e973caf3b0dfcd964b621ce1d7c
SHA1 bbe23c9b41a8973b8b8777ce49b7f907c65473c4
SHA512 bce61bdec716024113e25a1504604f9f7b8122386fb7364d85ff88c822d7a83564622f2019d9d10a8fffad648cfa7d94d6f9e172489fb621d2a7b457aa1e97b1
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZuKF:WqFgqFUHP
TLSH
T1DC058D07E6A244FCC557813089E69372EB71FC225720A7AF2768E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 815KB
SHA256 308fbabffea766b0d4cb55271b5ebf17d4809069c9a46e778bff2f6d8e16141f
MD5 949c21b7b640ac884378772f1d2679d1
SHA1 8bd5ee590bd6256f49323db02fb43fb86074af03
SHA512 8dd42fb484ae86a2d0b520c63d71ab032fa12d92c42b3282d5af3a41838329645819ec5f4dd1308d036b8c70e9f9a818a90ec4967f85b5eda98fefc715423c52
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZufC:WqFgqFUHD
TLSH
T1B3057D07E6A244FCC557813089E69372EB71FC225720A7AF2768E6252F21FD06F3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 815KB
SHA256 d6f4c7cb21cfb74db16bce49c4ec296f3aa02346556654752fda97ca8ea9e3ed
MD5 d98c96998dbb68dd0f29dec209987bef
SHA1 4e481429ff851c79b303813f09e6db2d5ab61800
SHA512 c25de66f7a9dae5286ac85e266e7b57662c47499b5e8bf1f1eb11696d5907386b1315bd1abd31be4154b5f2b7cae99ec9d5e316b56fd36826b264a81448a12f2
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1Zugw:WqFgqFUHG
TLSH
T134058D07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 815KB
SHA256 d2165c601670729730afdae99b7c930c6ecf5357bd2e69aaf82909b8d5cad391
MD5 9fc71d2c291d70c464fcf7d478afb332
SHA1 85da6f11fd41322c9585b6e3261a1bdc35d822ea
SHA512 1dce32da3aa419924019e229e37e3e1139f1c3dc2f5ee0d16f03f5f114e55810f96fbc5ed554f17e5d356baa83e000f2de4380eef3ccc4848883bf47230c97c9
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1Zu/T:WqFgqFUHG
TLSH
T154057D07E6A244FCD557813089E69372EB71FC225720A7AF2368E6252F21FD06F3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 815KB
SHA256 c1d99ad9b7dda0f99e34d4f40c7e10f649f372cf70ba00dd210eed966d4f6cde
MD5 502c95dbc478167dd8ce78baad7f2d47
SHA1 b62a5141bf58b1df544bbe240e35ef207d5714f6
SHA512 c8f760972fe743ac0b7de9d9c39f2a3e8de700454b8840cb36105502d344a3b74b75895f1d64977d7ebe1b8aaf187bb4907661d61f6b19db043d4a9db2294507
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1Zu5u:WqFgqFUHh
TLSH
T132058D07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 815KB
SHA256 0252daaeb6d382ddc4c5cadc45bde2eec6da8268550b75626f046c67bfc49789
MD5 c3508dd015789fac88b0bf32ddcef0c0
SHA1 3205d63a6a63808021d2ed5a75147ccedce4e14d
SHA512 afede0de372a584f58bbfe6190fdbe356ec1247dca2ec2892c5a2849894c0178091c170489b9f2e749b189fc916b4a2768a4727598c5a5aa3c390cbe054be010
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1Zuxb:WqFgqFUHA
TLSH
T120058D07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 815KB
SHA256 7385cc33c58f1804ad1217c38f3024721009392c10ae5795b9e5bbce9dbce6c5
MD5 36525b35aa1184cb959f1ba833946bdf
SHA1 a3bbb035e335a183222d005af114203781d89345
SHA512 1a7282753663530df54b2897c7b7584e37e601bfe4bade73231a0aa272633f2579496ee0403f8b9f73171aca9093b2772a9c0a4c24b7e5db75fe555181edb596
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1Zu5f:WqFgqFUHw
TLSH
T149058C07E6A244FCC557813089E69372EB71FC225720A7AF2368E6252F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 815KB
SHA256 37c985a98b05788585db624bd49772a680c8dbdaae9f96eaeca70ffc5f3ad63c
MD5 764c50401d24ec3d85d4787daf06531f
SHA1 63b72317cc1dd2f9dda263cfb69bca3bd6f5cee5
SHA512 ec6eecc031ddce43dd9f588929eac70d2e2d161ae655ead7985ed1483932b5dcd9000097c4574ff9ce15cf725ce8a5b06fc17a0546f3eb5418d6d346af75c974
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZuCK:WqFgqFUHQ
TLSH
T11F057D07E6A244FCD557813089E69372EB71FC225720A7AF2368E6252F21FD06F3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 815KB
SHA256 f1976ead235fb4c97d9a299e72657836a98e333a186e3415864d1232c30465db
MD5 25800221b4dd31eca67b470ef385e5a4
SHA1 c7986d4245faeca8b7bc6ad89ca8a1cc7a630caa
SHA512 366b208f4662f2c5d72ba1808f62d1edd719efe2fcc70b27316fbf9a3d18fd66c79fa9e86373d672a049ced988bcf91e3a67af25105de44a0d85bfe38d63f972
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1Zunk:WqFgqFUH5
TLSH
T103057D07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 815KB
SHA256 3f15ba0455d1078728471baaeeeedb4758c99c1b6596161678bbd9db9c4ea246
MD5 2826a58afc3dc8923f35b069a01ee2e3
SHA1 8ae8db09e5d0fd754913905d6655a0c7fc591e28
SHA512 b34ab577e5e96c5fb4da7d625d4d95c86b42c7f78bf54068be4c0593ca53f9d76784fff81ef9b184bac0efa75252e30a11834dab27eb66a09fc0581648c7362c
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZuQ0:WqFgqFUHM
TLSH
T143057C07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 815KB
SHA256 fbc7e6cfc185c6233f8f1330b5fb605911f4931c27e537f37298b1987d890cae
MD5 e80a08212d10a924ecb2965e84d3e5c5
SHA1 15b5a9079f09ddfab35c213a83b8bae3b8a5f62d
SHA512 98f6af1ab1ccb515210f824784b37534d154cb6e6bb3e91a74008ff97c59891e036cbea20e17009d9ed3ff2332ce20a7920b925e9980ca9cf4a991f1fa4a5050
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1Zurg:WqFgqFUHx
TLSH
T1AD057C07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 815KB
SHA256 92c4c7a9f4b07304a4c0b01c93369ed314b3dcd827cb0da34202f8d508b6fe54
MD5 fbfe8038e473472f44a86b2ba49beb60
SHA1 4ebb6dbc85d2ebf4dacb0a58c245409e5a61ad7f
SHA512 29f28057c5b82c347399d1210af3b12d1e1bef56d3292e2980ffa2fd9cd13586ef134383bc30ddd89b16e7d0fd3ec5807b78c71b4644205314e6d1092abfc868
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1Zumr:WqFgqFUHb
TLSH
T151058D07E6A244FCC557813089E69372EB71FC225720A7AF2368E6252F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 815KB
SHA256 c6356a74cd56ab72a647b25ad3d9bbcb196a94c2912a22e15195514e6cca08fd
MD5 d681cef33e8fab81401df5bfa16d1a52
SHA1 c5534741877d53b26688c7f5d73223be04f650e1
SHA512 bb28736d2a665b7027744b16b665d9c2bc0331d58ed7384ec86f4aee1d11c6decdadfd8f1921af0517a07cf0e7cbb897952e17fcd648f153dc7fa979839a3d53
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZuMn:WqFgqFUHt
TLSH
T1F2058C06E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 815KB
SHA256 e6f47b8af02ce4e0a6637ee843b46e763fe64da2c63c3d575caff9437afdbec0
MD5 0caa04077eda7975a0ff935c0aaae2c9
SHA1 9f17cf17bee88844416a641838716bb4c82bb699
SHA512 7ee3bc7568f4deb29d56df6ee17d607bb0d53e0a7caaa6e7ddba6e48b3e56629a638c75a845b31560a0374e87f8773c7d3ff5d2c15aa4b562704c4f78d387430
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1Zuqx:WqFgqFUHT
TLSH
T110058D07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 815KB
SHA256 294f2fe5045cd7c11040b55eff4b5bf9509b87d3f8521252a6e666450fcf9322
MD5 a228d235556aeecfb3729f74c55cc3be
SHA1 c0f4dfce3c709ff4a7d0b58fcf28243d2e0365e1
SHA512 5030774db01c6da2d2686aeb402d5f28dc815a8364d60eced0a31ca2703dfc1e38600bb4b71ee4f94a905eabfb04ad7ad26e7000256084fb880735d2e435950f
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZusA:WqFgqFUHs
TLSH
T195057C07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 815KB
SHA256 9e2bbefab380ad9fcf9e9015381609a0bb7227bc66f854340bf970129cc80216
MD5 e502af2ae73931001e278754dfa5a31f
SHA1 eb239a41f853eb5d935ba387f1ad0cfa969c48e1
SHA512 eea6575cb98a645976165ded59cefd25b2abd4f250170c9d5180307cb1cfb761ab14d75aa0b2e9a3733b7670c5007407b28b104a759ed416ea3f98a46907c8e7
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1Zu19Q:WqFgqFUHN
TLSH
T1C1057D07E6A244FCD557813089E69372EB71FC225720A7AF2368E6252F21FD06F3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 815KB
SHA256 26773616cd64171808413dc578ff1c111c9d62133cf2310f2e59ff0f2a2c7f8c
MD5 1c9ee69848917861755fcbc9816e9fb0
SHA1 1ae791070be1a716cc2f738b77ed267ef3af9caa
SHA512 9814d037b88b809792b0ed862f07f0df2dd491b85b7921265637eec489168fdf097f9dd68ca45e6be4c461e624a96c4fd68a61c2e822e14cf53f044c2d1e6a60
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZuA4:WqFgqFUHS
TLSH
T1B1057C07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 815KB
SHA256 bfd395def9650af0553fffa84634060f5dc394fada072e1a0187a29ea21e2578
MD5 a8cadd059248bda45c8add8c95f4f25d
SHA1 931c2e26eefb1045df1a0340bc1177187fcaf181
SHA512 2d113cc1c7289495f2f6d96cdcf75e7f65125b7dc0006a82873b2af8c2ddfc32519bb4afa5e9ca0d1b9bdea61521ed7676f6d9814e24a898dddf148941fa7209
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1Zuju:WqFgqFUHD
TLSH
T16C057C07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 815KB
SHA256 d4a4e5caab1018b2f5b28cef3a49eb645adc34ecd7c940a6c68a462add39db9d
MD5 a1778844604df2038b70348c46955510
SHA1 23c62df14ac2cda076512b1bbb42be1d37a63f45
SHA512 57b7828a572bb165b261ec825e1022c7cccb929d69045b900351e1b36498e2753544d48cb71f46af305e9ab18966437511b27df55798b1f3a512b4a04e599116
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1Zu+j:WqFgqFUHt
TLSH
T14E058D07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 815KB
SHA256 482208230e5a1114e2baf833fc88e1a2a63f459c3f9bd19c8ec2ab76f0f101c9
MD5 106aae0a9e8742b0a8b115f5ce687a29
SHA1 cf1f6cd9b6d7cab934d483b448ff6d9d3692e025
SHA512 516495f5662f42330fd8949164c5cac8f7174ae8d56897b12966d1340163ba8380b7f4e3bb966db35149444e88e322a6faf8f8f3f8ad9c4c98ff9f2fe7bdad9b
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZuLg:WqFgqFUHx
TLSH
T112058D07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 815KB
SHA256 135fde16203b16d41b157b8a5e63b80e7fc18d9d69b29e23ecc799fa91b0e7b3
MD5 83c11065c1f18dbcdea225aabdd29464
SHA1 6205a20c4b089cd84856c9f750e7d94355b56052
SHA512 7f2f04848def264ec7da7890ca458366a13be966fe44e5db43717a26b834c3083b278d11e007411b24cabf6c3e88efcdefb88a6ad23b2bc0c102f8e39085078e
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZuWI:WqFgqFUHg
TLSH
T12D057C07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 815KB
SHA256 775b60809b189dcf37a392e0194470f5faaff85a0863671a0c38adb759ec7d96
MD5 3931d8e0bd1782725e2721a588cbaee4
SHA1 0985b79b408f1bea5d13901d765dcc10582e8122
SHA512 88b9d810468113a25ccc30ae50626b54ccb5c535117d56ec8cbeb23f9653381ecc44d5f9f5bfd534d167b7a1cd6cba3da178bd12d79adcb97ede43e21e1436f1
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZuEo:WqFgqFUHC
TLSH
T108057C07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 815KB
SHA256 a640c670a49112104ebcedae03af9020ff03480c112031a5f70ea8a7ec405ffb
MD5 8866e1d5a1a13836ccc01974477aaccb
SHA1 e91b6abff014cced96da2d7143a585de2ac02c3b
SHA512 ddbb9259002e68178f64cf9fb5b513fdbc3db9597132aafa15fbf48a8b12bbe928a73539127e7545185d22102296e5a04059c9009a2df92cf37cf163be9a9d9d
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1Zun+:WqFgqFUHn
TLSH
T11B057C07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 815KB
SHA256 a4af937f6c516f9545e206911c946f7590de92672982f0880cdd6f52294162a5
MD5 59f131ce7e6151b8a795f6c015f12da0
SHA1 c72f3170c1dffb3d0c63830fcabad5b95860ff7d
SHA512 5b0d9617bbcab96f003f700f2f127778926fc8edb8223190d6d60fc08d660bb34eabd32ae5b472335cb941a5d9d1ca75c3b74360765e10068a6b64e1665c4fe9
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1Zu9Q:WqFgqFUHT
TLSH
T161058D07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 815KB
SHA256 0b96217850de43268069a8c618dbad30efee24684c403956d0f27019b4451df4
MD5 ec6d6f7428ba55c3b9b27721e2901379
SHA1 c7349b9724d46ccccc51becc4f4e4b80527b296c
SHA512 edd9fa6ebe5acd9b8668196695095ca0ee787ae4a2e25da6982956bba19e15d5cb6b6394dcbb194f3962b1b6ecc66457d7f09ba969d94b4aee396c9a06be624a
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZuyX:WqFgqFUHH
TLSH
T156057C07E6A244FCD557813089E69372EB71FC225720A7AF2368E6252F21FD06F3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 815KB
SHA256 634badcfc77d5c7150ab196854681d57ed3071d5d71fd59c7f65b663cdc39c43
MD5 75ef288657df3d574e5becdeda7c28f8
SHA1 d74467efd55372531ac8ee34fb857ce803250ec6
SHA512 d1078827141bdc3017348cc41d4a5d091dfcae8f2125a534c9ab0b42b7b22c4296ffef2f2b0ba0fa09fcf9a919fcd2fa03d64780c899be90ae8f3c77c70d26fd
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1Zu0L:WqFgqFUHp
TLSH
T128058D07E6A244FCC557813089E69372EB71FC225720A7AF2368E6252F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 815KB
SHA256 070aef01cc016fe934258e9cd95f3081283471686126496022e5614fa3f32d56
MD5 46bfea20a317df42ef600b4ab6c424fa
SHA1 ba0b60c0d2233193faf0bfea2be9502ac2f1e918
SHA512 4887eb49c048ac71fb685ba78776fd5b4b7d5d80b3f2d5c82a9c2adc0daebdda616ac6545c692e0b077e6dc5fd363d1b58a066133b2591712f75388797d8c213
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZuQM:WqFgqFUHQ
TLSH
T178057C07E6A244FCD557813089E69372EB71FC225720A7AF2368E6212F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 815KB
SHA256 da077c558ca8e9cbf3aec1b5e0f9a00bf01043c14d8a8b0d58faf29e699f1cd2
MD5 382feb4fb97effdbf0ea4bf00f6a0b57
SHA1 55648fac8e8bafbca12ec4fb8690f9df51100627
SHA512 b0bd9cab13e67177a601d06a71deebac2f3744d44963f23ec001a8eee4c93169ae876801357033934cd414f9f3593f56d502bb4fca8f2e333bf3c59b4d7f9446
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSs1ZuRh:WqFgqFUHC
TLSH
T11B058D07E6A244FCC557813089E69372EB71FC225720A7AF2368E6252F21FD06F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/400-2011-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/6096-2012-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads