ce7b483b6cb98e5eeda17dee9b645fe14b410d350f1d3299c9fb360260dd25e5

Analysis

max time kernel
116s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_bf046b6fe2980f03275448239a062a24_cobalt-strike_conti_elex_hijackloader.exe
Size 765KB
Sample260804-rnpessyzes
SHA256 ce7b483b6cb98e5eeda17dee9b645fe14b410d350f1d3299c9fb360260dd25e5
MD5 bf046b6fe2980f03275448239a062a24
SHA1 bdd7b06807fd03fb4aba039f8016f3e57b1cdf27
SHA512 d8a632f8c45ead3c056f84fc0c7ac41d4092f7136e4afda9f0d5b10c358f35f8f0ad71aeaca1d56011af74800aa910c47bdcb10c7793cc787fc8b853352b6b47
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSsCjmN:KIifqFu1//IifqFuyDA54GX79lSsCjmN
TLSH
T164F48E07F6A244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 30 IoCs

resource	yara_rule
behavioral2/memory/3896-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5bc-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c8a-58.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5bf-154.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001996a-519.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001996d-598.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019974-623.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019962-714.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019975-739.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019976-782.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019977-819.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019981-850.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019982-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019988-882.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001998d-889.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001998e-902.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019993-915.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019997-928.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001a3d8-1001.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001a574-1075.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001a841-1124.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001ac7b-1313.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019e4d-1345.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019e4f-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3896-1423-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1984-1424-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000066ae-1809.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000066b1-1864.dat	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
1984	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-04_bf046b6fe2980f03275448239a062a24_cobalt-strike_conti_elex_hijackloader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_bf046b6fe2980f03275448239a062a24_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-08-04_bf046b6fe2980f03275448239a062a24_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-08-04_bf046b6fe2980f03275448239a062a24_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	2026-08-04_bf046b6fe2980f03275448239a062a24_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	2026-08-04_bf046b6fe2980f03275448239a062a24_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_bf046b6fe2980f03275448239a062a24_cobalt-strike_conti_elex_hijackloader.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_bf046b6fe2980f03275448239a062a24_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3896	2026-08-04_bf046b6fe2980f03275448239a062a24_cobalt-strike_conti_elex_hijackloader.exe
1984	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_bf046b6fe2980f03275448239a062a24_cobalt-strike_conti_elex_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_bf046b6fe2980f03275448239a062a24_cobalt-strike_conti_elex_hijackloader.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3896

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 765KB
SHA256 ce7b483b6cb98e5eeda17dee9b645fe14b410d350f1d3299c9fb360260dd25e5
MD5 bf046b6fe2980f03275448239a062a24
SHA1 bdd7b06807fd03fb4aba039f8016f3e57b1cdf27
SHA512 d8a632f8c45ead3c056f84fc0c7ac41d4092f7136e4afda9f0d5b10c358f35f8f0ad71aeaca1d56011af74800aa910c47bdcb10c7793cc787fc8b853352b6b47
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSsCjmN:KIifqFu1//IifqFuyDA54GX79lSsCjmN
TLSH
T164F48E07F6A244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
Size 864KB
SHA256 99e6c9146702cc6afac80a42bea9009e35d63f731acb998563ac683d2cc73f93
MD5 57d1185119476ca4539f326a003efa83
SHA1 925b92f702ac59d7a6fba89af39fd6aabe1823fa
SHA512 11a03c9d6ad51c1bea000e026ab0f4a9908638a4de8bc66a30db8d5248f9ff395d161d558bc2af001f3b7d40f0d284f2927dd1b7718617cd9cdd30dc1d12ca28
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjm6GsrzBli:WqFgqFUHDsrVli
TLSH
T183159E07F6E244BCD557813049E69372EE75FC225620AB7F2358E6252F20F90AF3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
Size 864KB
SHA256 2e855f6830c05498ad7061e6e7ac05d03f6fa0033d175c44cdbaafa1ff1e49d1
MD5 0728da347de7f55fa0998cbfb9755fa8
SHA1 62a0d677f4f96aa2b270cc16c9a031e7b65ce42f
SHA512 d83a0c27885cbbc81116adcfe55c3d88044ba58f15ef362557b868037fcac1944435c32188b5110f93f0ef6032a23a0e19d84faf10a6e07fec1b314fa14707d8
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmq2MqDBxc:WqFgqFUHLMqlxc
TLSH
T142159E07F6E244FCD557813049E69372AE75FC225620AB7F2358E6252F20F90AF3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 97d56f994c86da3b707936b0664fa3cd05cd42a90ff651d42065675a4f6862c8
MD5 e723ee0ff22332fe9a37fb3d250300af
SHA1 14aba69739ea232431162c145e14f4fea76aa93a
SHA512 6676f576f416bd888dc6c034491ab69d8cc4f4290d0cf5ead99845c1d7910aeca48773279838632ea7a85ff702c868703a2ce5c63df7ab14cb7a1bf79da09e2c
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmZ0Le5ji0hmxNrM:WqFgqFUHHPji0Aj
TLSH
T1AA556A16F6B04679D023C075C5E2A3B6EA71784217309BDF1399D7383F22BE59A3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 780KB
SHA256 246b05f0ec99faa7239e6ad52f819c730011ea6c391bbbe109ecccda28794a36
MD5 127aae559b7fa36e72be07929e1d338e
SHA1 232547861fbb999d1e5ca4517fed6f1d4d610a4e
SHA512 099f03bc66f655d6a6274e087cf049058bddd84519a85e74d16b86ec08da077930295bcbc29c574c3f43f0381720db6c7705fee96546a6d432c495c354d5f57e
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmLa:WqFgqFUH
TLSH
T15F059E07E6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F20F906F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 813KB
SHA256 0809a0633303e3493d41bd368da1e6e57c5bd2c4dc2940abe00088f9f856c2f4
MD5 111d333b1983a247bf8b54d128728695
SHA1 9a70115534bc68b1c1a9f917a2fc5e47d2a63160
SHA512 65b951c76831605592f8ed7d997cef81c345db258d2ce4656d854a8881f97251e6f84561aae0073907136bef5f10f1f6ab2f21ef136ee72c1b1cf7cdf36fb138
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmIb:WqFgqFUHKb
TLSH
T17D059E07F6E244BCD517C13089E69372EE71FC225620AB7F2758E6212F21F906F2A759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 909KB
SHA256 98d0672f743a80d2684e41d003c270d76ad0272cb03024491e6a1e96e492be04
MD5 9a875502432994305c8483655d446bbd
SHA1 71b657584c4b8d51a80defff96fe48ac77d29228
SHA512 8daf86b00bb12d325364599158abb1d9669589207870807f68e7f08a5522822e24e7a257d089704f47309a9e744e14e7cf46ba872526722e55f65f0b24cb4daa
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmiD:WqFgqFUHA
TLSH
T139155C06E6A204ACC51F8130C7A65372BA73BC1156E097AF13D4E63D2F31B906EEA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
Size 789KB
SHA256 aa12a68c6f46215df2a37cbac64edac866b2185676bf271e6ed202fa03a0907a
MD5 6f9122c188b6a7d76cb68e04f4733a71
SHA1 8493d30d30940e1aa0f62dc73e4fefe1035c5fa8
SHA512 2c1ab4261e233cd9823085029f55500fc856e0e089a460373fe541e5b7a967c16c24c6e509299ebf1c3434a65921d49565e1a36fe2b7aee3bf94b8aa0ebc6b72
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmXj:WqFgqFUH5
TLSH
T1BE058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 914KB
SHA256 e340cdacd70cf00733ba8b17a10dd5dd01d7efa12e343d28482ff6fc95c6dd30
MD5 8b3070947f18a4baf63ea54c8b97aa0e
SHA1 0955732a6aea9ec00100e88021afb64707dbda71
SHA512 4e60fabce25cc6d2d1d1f794c546260d86cb5412c21942304769524074ff98e9b46739cacceddd8173cefb5ab2d8d53d895552f081af819efb9dafa3bf390ff9
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjm5Hdfi:WqFgqFUHI
TLSH
T1B0157E06F6E204FCD567C13089E65372EA71FC125720ABAF2358E6252F31B906F3AB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
Size 789KB
SHA256 5940d0f0705d0654ac0920c32c1f1dfe25678d0fb1ed5b5e6ffff92b4bcd6968
MD5 2e7b21abcedead658a9aaa3f5205d149
SHA1 bae3dda11360e18b1c8478d8fcbe2596bcee07d8
SHA512 d1d17fc3343da9c8e76f3ec55a0e223f34dfc67a76cea531e80da6950dc207885fbfac415429a58191528088ef2a37f834de061506f81ea9c1de0b62ec5efe6f
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmdD:WqFgqFUHz
TLSH
T1B2058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
Size 789KB
SHA256 ca4c34c93492bf205a83d4a22213eddf35343343f9475bd5cd4d3a0b4f97fbab
MD5 8a97a733b1c6f9dbeede579fedb43576
SHA1 315fee68bfe6db2d65bb574b81d11bca90cc0e8e
SHA512 cffc009119618103d7e1939a8425143d9c749b848392cea761e0f2dc1ffb7e7e0a45dcf297509b3262a2a7ed1c4b31e347d30f4b117dbf91b454bea16770bd0c
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmhd:WqFgqFUH1
TLSH
T14B058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
Size 789KB
SHA256 d1e774a71bafd32317743ad67ea0d3d9e13dbd37489f0b11cb341c33dabb0167
MD5 79215719727e275c4c08927161832f9e
SHA1 4b5690fb40fbfbb6a2c59a9cc6f572c532c17dd1
SHA512 fd1b5b01567c290747f119d6df27d742b4ca594a5c9779ff76093e3dba3bd891e12c7492af8624b55c963900634225fb0a4e4a1043656c7404390c0383e55a4e
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjm9M:WqFgqFUHE
TLSH
T185058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
Size 789KB
SHA256 c63006e2fd56ee849d3ea332e77f5caae6c9e3d656a083c952349ca6aaf44276
MD5 6f7ae430eaed5842a9c6ae8f2e8035bc
SHA1 a198a401cd155170a385c9a0a4994a65e8801f8d
SHA512 f81c5cb86278a0c55a3f1e1c1566e3a5750ed732b6bf8c7e8a1f79886dda611b83bcd0ac786a2665f1641bc3b4118e27c5dedcadffb64acaee29b88b7456f074
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmKW:WqFgqFUH/
TLSH
T1B1058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
Size 789KB
SHA256 f1890a93e87c984100be55acfafc881e1822529045c9618c648301e350f62c26
MD5 31b19b36c87712526225c8d868be4c4a
SHA1 bcb67675bcc8b30f397f433e1758d99591dfbe2e
SHA512 926a5845e3d6de28a0463560fa28e4563e77ce071968591d08d75e4ec12c3a4a658d152c4493114e38da17567681a545c7725b38bc26c56455f29f4cc7661cd8
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmV93:WqFgqFUHN
TLSH
T13D058E07E6E244FCD517C17089E69372EE71FC225620A77F2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
Size 789KB
SHA256 cf20a1da255e310872a4d4022cb49eae7ac4bddd79003592cdbbe3cb3cd43940
MD5 0b756ba8b0172a400239ea1d07b5d6e6
SHA1 0667147dada10e7b6aa25c48443efee981f71971
SHA512 30662606dc428ba19041e07881dc2b70abaecf480f44a2062404306e799dacb7d9eb3b184a49d4f690b3e52af52243537172af013f0421aefd0e3de620f0a482
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmf/:WqFgqFUHd
TLSH
T11F058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
Size 789KB
SHA256 c35eb1a7144ce9eaa0cff89fadb11c44c1e7ef4669493df8f483f75f68337a36
MD5 a29e5846df5dc77185a0c688cdcd9ab3
SHA1 74f1595bb93b51b736ea198a72af505db3b16d18
SHA512 d8b8053b4ab79afd386454f072777d7d7444b628731a3f2e3d1518b1a78fe623623cf16543b390be1515c75ee884199ec4d898df039b9df73099ff6f2a4daa10
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmNa:WqFgqFUHq
TLSH
T177058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
Size 789KB
SHA256 21fd05bcb975036793ca3d8bc06512bccf8b2ac26e7b24309354511af7a2f5d1
MD5 c35d2d963d115488b897d4d4ff9447cf
SHA1 6d6681410c11e4215ac917234b6a68e6dfdc2fb4
SHA512 f39a9c2b4e5d1b422c8b9f155146ec4976cf364136ab009a0f4a22028beb39e07c68d2441976f4411d84deac0c068747be227cd38459baa4fa72a3f3db573383
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmtj:WqFgqFUHv
TLSH
T1A6058E07E6A244FCD517C17089E69372EE71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
Size 789KB
SHA256 ab2735dafcc2d6f6888cf457c04bba01a34985bb9dcab06db8926ce42ff4797d
MD5 691d788d3be23e70601b0be8e476666d
SHA1 750f5a43efe71a1c815dc0d84c0712e3927803f7
SHA512 0ef9af2acbf27151e155e68cc980a264883f4bfcf7e63c02ebc340f7b5a85cd9ab3626d6e71682eba0e77936b47d79dda7acfab5a1b4bd8f75955ac16ac870e5
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmqQ:WqFgqFUH/
TLSH
T1F0058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
Size 789KB
SHA256 f6c492fced8089f117c75dcd4ff60497789baa2fa910672cf922ac0338581586
MD5 22f15645b8123ab3e6f1df7b386c3b3c
SHA1 1d3c0f36da797827816b22e44baae2f58ddb558e
SHA512 904f6c8b91c1998d25c17d83755569c4668cbeb3b41525d9df8b9b1bc525632ee953b983b01580fbeb3e51aada3ff9199af00f5c6360edc0ce2acf5588add2db
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmZi:WqFgqFUH2
TLSH
T17C058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 864KB
SHA256 adcf2545f18b31ad060a8de8b36dfa41d77412e62a02b1dcd09542398c3af429
MD5 4e387ba03902aae80c831a225cf3ae9d
SHA1 d8def57b7a09cfb21c03e0583b740d5f3f79a61a
SHA512 b7a97254bc7682c69de146f6b389fe9296f90824daadfa9e990fdc8fd2bd804321a36ec8b9fba8482e4926a3feb5a6474429ca4ede8b4abefb48dfddb0b4d6ac
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmpf2a9:WqFgqFUHD7
TLSH
T193158E07E6E204FCD527C17089E65372EA71FC225620AB6F1358E6252F31F90AF3AB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
Size 789KB
SHA256 1ea665fb1fdaa20b880ce41e7fa7da0bea138d87d3f3d02b4d906e39f6e01daf
MD5 efd474745bcdc559724bd164e9461068
SHA1 168a6ae6c10fc6fccd0b8bafa89dcb09284f4b93
SHA512 a9f8965bb7b7744b6fda7465158abd22f80c62c28591d09df67c758fbcb5c92d9dc816d6fe7bd1cfd87b7b9caa17246043feca4b5debf693c5f106e03e28cad5
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmt9:WqFgqFUHh
TLSH
T10E058E07E6E244FCD517C17089E69372EE71FC225620A7BF2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelperBgt.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
Size 799KB
SHA256 0d9ee9b003f77b35a3d8a993aefc6f9a1fcdd87ac64f1ed03f6bc45b0f676cba
MD5 f98ddfad6074a5c33c0a4c4bbde6e1b1
SHA1 9fb61670d04d77107110cff23e4beb19264c86bc
SHA512 5be24c2694eac2af6649beeef08a50bf0b5db1e881832cf1ebf6e1c31dce0c954aad8095f1eb6595dacad1b298491a0523cddfb7c77ed2230053c039fbee1261
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmU1:WqFgqFUHW1
TLSH
T1C1059E07F6A244FCD517C17089E69372EE71FC225620AB7F2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETLANG.EXE

Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
Size 841KB
SHA256 f2396c34c65522d3200d86e12d17c1f7e70a2fbc15df6048fbab27cdceb03fc9
MD5 0dfa7852053742a4d6f1850262015f90
SHA1 980138382264267f04024dcf382b4bbfe19738ee
SHA512 d3c88a2aa7bb5930fa62d2a8ebb07f98e9a8ab733cb2dd41101c57a8adefcf024de77f6703fd098126656c809c1786955d857f83aefe2f2e9a3baec880984abc
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmKkUl:WqFgqFUHY
TLSH
T1C4058D07F6A244FCD557813089E69372AA71FC225620A76F236CF6252F31F906F2B754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wordconv.exe

Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
Size 809KB
SHA256 87bf6622be93a36bb2d2c6b04855e7c57a98ab93ae896752ac6e9ba110351bdb
MD5 0949ac057170dfd701fce11c0a3f4a73
SHA1 01bb1b20434cc0d9045392780379fb4500f0ec4c
SHA512 efcdd6d38779cc8a0203b0f6f47c91f21d1bcffa316604e74fd72f3fe7462da2a2257d8526160479c5fbe21daf0038bad50f9294a1d9d9196610b251d79dfe76
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmUwE:WqFgqFUHA
TLSH
T1D4059E07E6A244FDD517C17085E69372FE71FC225620AB7F2368E6212F21F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msouc.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
Size 821KB
SHA256 13efa60313c250ddf156b394a1a7965d49745979c00bd1f32755f11c4c32d62e
MD5 326c47db54a55a962959a56b2e5ffc7f
SHA1 6525dcd2e28ef22cfb9809eececc7fdb14355ae0
SHA512 b7742d0e43fe117c0295721257822da7e87a2d6e5582841eb4a7df67a5960afa5fb0435ae0eb530bb6aeddeb42bb4ac777a2a66bd0317fedbb9ff4257e2fe568
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmb2+:WqFgqFUHk+
TLSH
T1E0059E07E6A244BCC517C17085E69372EE71FC265620AB7F2368E6312F21F946F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osmadminicon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
Size 827KB
SHA256 1a9f8f410e83ddd0a7f332dcbabfd4ef1864c362f08a539878b9f8eb8957749c
MD5 fd89422808a8ee43e99d6ea72c63e48e
SHA1 b7a54fbacce77b13c9e709980dc7aa97c857b4d7
SHA512 853993b2c84ef0c866d0d458aa112da41ea52aedc88a9b3613f35ba751ce2606a3b2217f854375b2b16d30fa2f9357321c255df4f54930d6a2ba23ae673e83d2
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSsCjm/6:KIifqFu1//IifqFuyDA54GX79lSsCjmi
TLSH
T1E5056D57E59248ACC517913045AE9372EA71FC1A1520976F277CEF212F20FB07B3EA68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sscicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
Size 845KB
SHA256 55b17044848493f5e6d9fdc3dc7d8fd70991ce7d0a33f53c1c422be6a3263d5f
MD5 fb4d06126389aca5f0346491c3d3e2e6
SHA1 b18299f6e8192bcb13c21c222893e1be896c11b9
SHA512 b482c33eb4d3592adb54ed584ca310674b4e3b161d542f9649b619922c828b5f16837969d7b47aef98e45ee6ea778607eb68897b2b56a00754290ed393b627a9
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSsCjmZF:WqFgqFUHZ
TLSH
T147058E46E6E204BDC6578130CDAA9371BA71FC511620ABBF2368F7356F30B907B2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1984-1424-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3896-1423-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3896-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads