6d870cc2cffc4cac93162fec93310abcc3005a8ca9e52b24320086c1e6aefe2f

Analysis

max time kernel
100s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
Size 765KB
Sample260804-vw2a4sec43
SHA256 6d870cc2cffc4cac93162fec93310abcc3005a8ca9e52b24320086c1e6aefe2f
MD5 feb16cd25824587a5e2762d9728ba480
SHA1 ee6baa5a22fb6337e19e4ff8d2062f74fbb2a809
SHA512 35aa3550cb681aa1d1709abe9296b5173b968efa03c902b91c3d35c475dc6208545732f8a347047811cff6c181f9e341dd773b404f4225c2a3aec187fad7a4a4
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGl9:KIifqFu1//IifqFuyDA54GX79lSzQGl9
TLSH
T1C8F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/5800-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5bd-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-45.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-475.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-494.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-585.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-622.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-701.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-726.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-745.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-794.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-837.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-850.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-889.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-902.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-921.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-946.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1002.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1045.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1076.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1125.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1144.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1169.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1201.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1298.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1323.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1336.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1361.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5800-1987-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4192-2006-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
4192	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe

Drops file in Windows directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5800	2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
4192	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5800

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 765KB
SHA256 6d870cc2cffc4cac93162fec93310abcc3005a8ca9e52b24320086c1e6aefe2f
MD5 feb16cd25824587a5e2762d9728ba480
SHA1 ee6baa5a22fb6337e19e4ff8d2062f74fbb2a809
SHA512 35aa3550cb681aa1d1709abe9296b5173b968efa03c902b91c3d35c475dc6208545732f8a347047811cff6c181f9e341dd773b404f4225c2a3aec187fad7a4a4
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGl9:KIifqFu1//IifqFuyDA54GX79lSzQGl9
TLSH
T1C8F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 afa1a3e97370b553271c2bc1fa83149e3bb144d48f088a781a993244a6ae3ba2
MD5 bc082c3569086c5b337cb10d6072daf9
SHA1 d8abfa0ffc58ebb4feedec7a71b614a0d2001a15
SHA512 2a735e40c7510162206df204e11aeb0f106ec3140b50a4602a08d916a427212d48a4453fb957dbd20d433ea244d4c9d405e235b0d7f771da1ff321428b3f5530
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlJ0Le5ji0hmxNrM:WqFgqFUHIPji0Aj
TLSH
T1F5556A16F6B44679D023C075C5E2A3B6EA71784217309BDF1399D7383F22BE19A3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 780KB
SHA256 2318ed6deb05ab904f3f9d48ab2e65aba3e855741be98864b298ce54f13144e5
MD5 0981d839fb7d5b06df63257e51d8bba2
SHA1 654d2c136ccb9c16a7291d00f2c776dafe617951
SHA512 0217d44e930e1b005be9a0c8b617f0c6d9af5c2b0d4910f920863e2f2f8ce9d2a56dd78541462487741841777fb855657f8498c928dd7968ac25b0be086f299f
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlba:WqFgqFUH
TLSH
T134059E07E6E244FCD557C17089E69372EA71FC225620AB7F2368E6212F20F906F3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 789KB
SHA256 24724ab00f86286d88788a0a5ba13d3c9a51afc541f2e6bc3e5cb3018325e436
MD5 8219ca2d1c9767b8a176f22a887be4e0
SHA1 c8d468edc16f4881d3c44f1ef63339d570c57fbf
SHA512 e0846a103a671134d1d1e182c700886e6d26b861414b879d344cb5d603720f4d1e8b24ad5f6ce0a8c83c4af4a87fcb9d407039776b2b160c3736e539d66a9d1f
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGl66:WqFgqFUH2
TLSH
T1B3058E17E6E244FCD517C17089E69372EA71FC225620A77F2368E6213F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 789KB
SHA256 b32eb17ae1b34dc9c8aad7f8b8a22097fd58a37b4aeb0bf2b905260537ea698f
MD5 18dc0fa280a0082456b66dd405c8f823
SHA1 b045ea55c7aae97e1eef3169f92fc289a97317d0
SHA512 ce29f170834173fdfa9c21c3451faf068ebbfe3683987f3c1c41ee7c8a397101ebe3476b1c1c5628b90cc12a726fa32930dfeaaed69ef36795afe9aa507a04dc
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlyN:WqFgqFUHH
TLSH
T130058E07E6E244FCD517C17089E69372EE71FC225620AB7F2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 789KB
SHA256 1646f2dd0f8a759a1096680bad1f016c65856761b1c849c996d7b88c0fc30e0e
MD5 a50b83cda71682d33df670b48e0ab616
SHA1 e8c66d36a2bcfb8c45dd200e93bea0dfa92b5fee
SHA512 e1df2bb45d17cc9c83e60273ba385ec2ea7dedcf04664ce076f5743680f57e8dee6017d8c85bf9c1de7bb3e793bac16c33f37578e727ce14a3a6ff77a562865a
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlof:WqFgqFUHj
TLSH
T176058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6213F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 927KB
SHA256 97bdc16a436b27cdb8b3792fd6e16dff0da4f0cb3723851aa27806b0d57bce78
MD5 3c2026f26ddcbd9aecb7ebdbe5ee760a
SHA1 68b031eda09e5354c4c39d621f4b6b2bea1afa33
SHA512 5efbe4feeefd6a59e34735c6222189f289ad6d6ad9070227465103c1b9f9674b9e785ab9e6fc713eca069e263090d3e286e2025f635257c7e9e0fa175d19fbbe
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlrzy7:WqFgqFUH6s
TLSH
T1C3158E07E6A214FDD517813089E65372EB71FC225720ABBF2368E6352F21B906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 789KB
SHA256 ca5807ce33b589238ea97184309c9957fdaa718d809feb116d7f167cef3d8dad
MD5 76238ef6e5f24a6b8665e75fcc1d43d0
SHA1 62c9d2fff775892b51ef6bc1f452283a7c2f9687
SHA512 7f66809dfdbdc8534ae4dcddc55904c08cdc0ad992f7cf5ed3fd907a42a890f1efb3d27f5312e66cf47e9181e91c2415d05dd48570cc0b844bb82e38e2bf14bb
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlCo:WqFgqFUHS
TLSH
T1BE058E17E6E244FCD517C17089E69372EE71FC225620A7BF2358E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 789KB
SHA256 67bd704acfe087a3ad4958d0ddabda981b4ee2c09b38a0e65c793ee12ced8796
MD5 220e7e2d47cc31f09fb639e260a03e9c
SHA1 16547f2f21c1e18e8016e97f618a29aae15ebd6e
SHA512 a4697536eaec42292e4f0a13c08a4c08c82c7f1197c466a858aef60b52c1434151eab2d89729150412e5702f6d3ce72ab01aa65b110d821d6e36aa3108427ef0
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGl2u:WqFgqFUH8
TLSH
T141058E07E6E244FCD517C17089E69372EA71FC225620A7BF2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 927KB
SHA256 920aca6b0613cf16e05830e2a13e01d98fb82c28949335625c58b026e2b9997f
MD5 f6a52803dde5e3fad1955c4b5cc10235
SHA1 9b5594f55219340113a5d9aab52d10f3296a9fc4
SHA512 fa2e6d56147f6f63d35be326a40d98528e3e82b4d45562c868563d83afb5e20401947be13ce2bc004ab51eb097f7d76c64c6a9540b12525e75f11b96c996d58f
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGl+zy8:WqFgqFUHHT
TLSH
T124158E07E6A214FDD517813089E65372EB71FC225720ABBF2368E6352F21B906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 789KB
SHA256 e5e823a9fc8c01d37d61f4c08665e3052827d9be7545843ae4fbc285dce628dd
MD5 9bde6ff58cca60185e0fb258d63adb72
SHA1 ed03f1eb16b31e37b7b356921e0be52560000160
SHA512 8ded1e25143b068dc7628f2df7a11fc22fdfbe8034a2d83ba08a8f2b39e2e9e2bcac09e1e72a840805d4d64649dc12411cf66b08e99a592a2ff42544b1c612eb
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlq9:WqFgqFUHh
TLSH
T155058E07E6E244FDD517C17089E69372EA71FC225620AB7F2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 789KB
SHA256 847424b2417519ba904f40125235bbb4faa285e1df4cd50ee106cebce2499a50
MD5 85faa89e4d991e0a232423228cf441af
SHA1 48330e5d8f3d99299bf134868825fde048eeb06f
SHA512 564e6c1536fc6cd3047616f0eef651a057e1922b64b7635d22c7c525e763c338a96857005e1f730767491f19db7778dce81c8f5525a6312ed7c2df118a532aa1
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlqc:WqFgqFUH0
TLSH
T124058E17E6E244FCD517C17089E69372EA71FC225620AB7F2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 789KB
SHA256 2755fe403d77123e0c28f11e80817ee15c148eb1127949b750a0dc803ff3fdd6
MD5 46f7e7404a7dd923d1ebeafd75eda1fa
SHA1 c565830638d72c4e5555477fa201532bfd6a0546
SHA512 ae5003bd00a5bd6c4a359acb662af7763759a12cd7556a4d8bad4970097bf202b9c80e77334d2ec7c64007d6c25170368f89ab93f04912eb8d96b2199e8f80e3
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGljp:WqFgqFUHi
TLSH
T10E058E17E6E244FCD517C17089E69372EE71FC225620A7BF2358E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 789KB
SHA256 3bb0c40643f4673f7860424b5dc78d2966b9d908be0025ccbf86495b126227b6
MD5 3fd84b409559f99fedafb9994164a12b
SHA1 b504742c78dc93fe96d98c8881fd1b1a6c2b0960
SHA512 f8cbcfc1a182605a8c817e9dbc930b77461913dffe087fe143be04dacc38b5cf674bd680ba754f39976edd7722e6651aa5b758157794b6fcb019a6752ddc900f
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlEN:WqFgqFUHF
TLSH
T148058E07E6E244FCD517C17089E69372EA71FC225620A7BF2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 789KB
SHA256 215d5cac55870bb68e00a700d82b7a2a5e8bbbab3dc00b332fdd47f1cee5682c
MD5 7a368f2f5d008d7c6b0e622789aa4f3d
SHA1 d1e74237d7323377970930d3aaa2f5b77eb57588
SHA512 d192be7e42dc2f606a3a0f30bc39100bd90d9432be929e6569170dd532d284921933cda63a71c0cd3fe968b555c4a98459c4c6ff0e450cc7c9657713490e2d21
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlsF:WqFgqFUHP
TLSH
T16D058E07E6E244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 789KB
SHA256 e3b1be4176c3c60d823251220a7b50472deff6990b77d4668a264728872ea0df
MD5 4c49884216afd8ce4b5f2373e35999e9
SHA1 c9a29b153c9157b96c81794239229349eb652fe2
SHA512 8f7a7523acf0e24cabf17b4dfec6aec8d68f5e7fd60900549f8ceda655428f8ef4bb611428f98eeb603a6d716b4277ba0ec29ff5bcd53553b3bc7393b3e1aadb
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlZC:WqFgqFUHD
TLSH
T137058E07E6E244FCD517C17089E69372EE71FC225620A7BF2358E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 789KB
SHA256 777bef583201be18fa1a731ec96610d82e32bedbefa78575e20c257bfc0dd013
MD5 bac4ee5b7aa339ccaddf68d4b6c4f89c
SHA1 5af112f53ac475914eaa9aed4b05b411eda5db70
SHA512 dadb8fff997af8f13fe54b386bb2a9ecf13949e901f6977207654c6b77209c48cf711926a86206c68fd1620c9a9ed26141006a27544fcc644a8c32b6db54c2ee
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlaw:WqFgqFUHG
TLSH
T10B058E07E6E244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 789KB
SHA256 659c21ebff1c34d77dd30d500d7215955e50fa08c1991586312277d092e1335c
MD5 4a89674909b3f123a61a49b9421de2cb
SHA1 d133ffe08071173560c7c313006d3bfef0151241
SHA512 ca72f6193dc9b540db36e6be3ae21682693427168b1378bedbbfafc57007c7cd9348890d637a89f054885249c570de3b274b8d696f2187a010c92ab170e5ec5d
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlhT:WqFgqFUHG
TLSH
T1CE058E17E6E244FCD517C17089E69372EE71FC225620AB7F2358E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 789KB
SHA256 6ded98e706028e57ea4f08fda67900172f75e55421e9682603df91db69220b65
MD5 2b72b9724a47a2ed0265edcc9955420a
SHA1 f5787d71b5c054c2ef84a09cb3b5081f9300b04f
SHA512 04bdb3645a82b31b9c1a8d3edb9aaa8724e4fd9468d9be38b198dcf818796edf350e3f448bb32df30e82cdf0d2813381eca4cee0910bb76b53848cd5d49f69d7
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlPu:WqFgqFUHh
TLSH
T185058E17E6E244FCD517C17089E69372EA71FC225620AB7F2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 789KB
SHA256 0715ea923430de1f4271c05af085fd89ee382864299d133d1194f067aa9b073b
MD5 e9243fac172b8070fc4582095e1de66b
SHA1 64b430a2a8039b6778640c2e7ee6678b2bb65ffc
SHA512 e5a617956300cf03d2416d2d29766c4c4232767ee283e237f2f6a8625034021b9bf593061c130a8cb44bc22bed23862fd0f149f20f49005d6af3c7eb642eaa0d
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlzb:WqFgqFUHA
TLSH
T166059E07E6E244FDD517C17089E69372EA71FC225620AB7F2358E6213F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 789KB
SHA256 363d8cdfb4a40f41a13dc710dcfbd556f8b2f213d723516ea228f8ba6a0b0e62
MD5 9f8923df40de98079985a32573c11f6e
SHA1 85a78b413e3b9590935c68e659f9108d26f058c7
SHA512 222492ad91652eeb09d8af9856c7b5eb035dfe7b3a5c42095a637b9abbe73d7be45f663b577faddd8b7896ade505ba82ee4fcdf6db975d5da00c59d027e3581e
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlHf:WqFgqFUHw
TLSH
T1DA058E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 789KB
SHA256 f8bb04f88cab3df875c4c7c7ea9f23850fd2758cc7e446b34cd36ead6e1e10de
MD5 c406e43c11d4f2636f38d546ab392276
SHA1 4180f00b9ec5ed132351d5e3d50980d375e651f6
SHA512 fd5c6e3db676049010b3477759c51e793c06391aaf3a0c2a87ccecfe6437916d2a1d1c05ed7c1aab23260fc2f55f2f34b122970c0d5e6dcc7e29973c21cc383a
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlwK:WqFgqFUHQ
TLSH
T14E058E17E6E244FCD517C17089E69372EE71FC225620AB7F2358E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 789KB
SHA256 4e7d21be4ec985b4dff79a62a5cb9f8fa6debdc7be385eda8d624b0b63d96d7d
MD5 a12c85bcbdcb35f23d9399df670fe457
SHA1 97028fe1b22d8296ef2f34c3d0e66c15c26e1aa6
SHA512 72ff33de81e76f406494dfdbb39addfdc27b3af22c000e5031ecb57687260e4f020945ecc727ed9612e0d48127e180cae2be7dbc4137c74620f7b6edeed17f0c
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGltk:WqFgqFUH5
TLSH
T1F7058E07E6E244FDD517C17089E69372EA71FC225620AB7F2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 789KB
SHA256 78bea17fa73f9baca4d3a798722306e54739a7ef3d62e8d4fd83e630508b0ea5
MD5 9443e489fb9d861dac52d566e93648c3
SHA1 a5351286680911c7e47ffdf5d37129c130b3479b
SHA512 2417480ca33efd6daa844e2ff01246a798bfb13f5e709ff1d2c4929be18a225dc1433e6d7264a8be70968bb3a319b2dd525f1b69dc16ff5388592cee385671a4
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGly0:WqFgqFUHM
TLSH
T158058E17E6E244FCD517C17089E69372EA71FC225620AB7F2358E6213F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 789KB
SHA256 1705f46a523bd780421546f37d576cb341d385cdf1bca195da6716d20b37f72a
MD5 ec4649e4fc1134402c4f7a46c8df2f17
SHA1 4f7df9c9d98b584369009faf5724a1bf426f3c63
SHA512 3f049267a3e63b5847fe65cb529d0fc5f09d4b23f33152ab1075edf0c8cb171899ecf3708a6f98777c0b653e44922465a9e821b6f1091a93ea785c306b6d9835
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlBg:WqFgqFUHx
TLSH
T185058E17E6E244FCD517C17089E69372EA71FC225620A77F2368E6213F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 789KB
SHA256 aaaf0b5a55d86ec0dfd7d78963f3c7b3528e0823bfa6a0b1b5a41aa326570ba2
MD5 3429a09546f3b280edd2e977c041f028
SHA1 e46a2360deeed4ece0699e0b70cf5f285ee798f4
SHA512 d477c14bbc9c9221974890689f02bcc749a2384c1681f7075f43b768311c034e9b8eee7e84628695f23c6dbfa5dd58749d008dd3e2aa1bd1f74e3150beed5d97
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlor:WqFgqFUHb
TLSH
T14C058E07E6E244FDD517C17089E69372EA71FC225620A7BF2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 789KB
SHA256 15adc307782ede9bf69d25434f3178952b8c3a7db62e2205e338ca5723927b36
MD5 94d7026fe3cbc43f106cce1da31010c7
SHA1 d4659eee6a15dd582a92f3137790fd5de9365981
SHA512 dba959c5a1d85717c90fab7628f970bdd884b1280d95f1154d22e3d48b616ef3e6b8448df0248eb57a78a021077ce716e3b5b4c4f846f6724395ddc80d78b8d2
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlGn:WqFgqFUHt
TLSH
T12A058E07E6E244FDD517C17089E69372EA71FC225620AB7F2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 789KB
SHA256 680a460756483b965e624e12b82d8b333ff9b3228cb8157d33ca91026926e510
MD5 676717cc6cfdfc1a6e396e68485a8fb9
SHA1 e00bbbd09de48687e08ba0ddb51ec78ca8105224
SHA512 93863cf3ceb1159a115d786631aefbebffa9d30b985db0fee33458ba264702e4b373ba0d781da95ad5558bf31120d3583c25db65f89ae24b299456dcd0ff7afc
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlMx:WqFgqFUHT
TLSH
T130058E07E6E244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 789KB
SHA256 11449ddd117380cd34f213a73a7b6b3dc52bb9c8299e00477869f55feae79e83
MD5 1b2b45a532cfb659cb11740b6bf53379
SHA1 599b1e43bfc09b06831e5cbf461e751c1d475be0
SHA512 8201aab6563815f49f7c33e61d02e7c017d8b3d4d8db570bbcbb20b37030d20a36e352c6a2d68fa068b40bcb05bd0e0021774f7d1fe8dc9aacfb850d18cb29c2
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlGA:WqFgqFUHs
TLSH
T158059E07E6E244FDD517C17089E69372EA71FC225620AB7F2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 789KB
SHA256 d13a001eb9704f0a97451da059fad4d2e97381657a09fc10d6e96f913a1ac8ef
MD5 f5ebc17d3da00ae8d047a2cf7b69081c
SHA1 0a72a04c01781d762c737c54d8f17c2575250c40
SHA512 05a909746ae7c77891f278dfc82b7fb22b649b61cf2075346f0915db2c5a8a72380234304eb1f0b09e86b3d459120d93490df6fdc9056b68c8ca85e3f9d1d456
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlf9Q:WqFgqFUHN
TLSH
T1D9058E17E6E244FCD517C17089E69372EE71FC225620AB7F2358E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 789KB
SHA256 117fc0dfe6ce57d81b14baf7dd914d1fdae092c6b5379a65bff878b5e3f0c86a
MD5 bb1de66ffab37c6149d73fb3a00a3347
SHA1 15f8879130f27d30506fedf42e3bb3e109738e61
SHA512 2d12cb605f84e8513a532a013d9d68050a61810949b8a594762dfee2e7b73cf39027818fbdf1bfa50c394a6eb0a02c14e7304b3a285f1afa4384bdfe52d43a24
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlW4:WqFgqFUHS
TLSH
T11D058E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 789KB
SHA256 d170a2551ac7e887ebd8993b95dc16d8ff9cfc3e6f35bbbef23162c8707efff3
MD5 1fabb4e692fa5051949d6454803fc325
SHA1 89fbc5af02ffbadaf9769a482ec0f8b3060ffab6
SHA512 499e5ee88b94acc9ff331a4a9584d5b64450a8070e3857e861ac27792d47af2be2629acb5dab08e6c6802d41744299116f9283cb08bc968b2097c274ecb2fbe3
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlFu:WqFgqFUHD
TLSH
T1BB058E07E6E244FDD517C17089E69372EA71FC225620A77F2368E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 789KB
SHA256 d4975c28a144a9191b53eb3db2f7aad538a831c9396adf01e29c6d08b3185a21
MD5 9e5ec62476d6dfcc27e58765319ceb8d
SHA1 b9bea71737ff3d403e2b0088d28b22756980d716
SHA512 417096876f1d745725280007ba2154faef759b0a0cea17e0825380dbec5ace3169306a774566ccf2e5473dd5fa842fbbe6096492da90712e40f3d2cb8ad623e8
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlYj:WqFgqFUHt
TLSH
T197058E07E6E244FDD517C17089E69372EA71FC225620A7BF2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 789KB
SHA256 f2ce40b5198262cd7266af0322b08f789a798ce69117c553757ebda7c4007f5f
MD5 103f8c9a951927218ad6c4d308669bb8
SHA1 a5a0070af24bb2a86844ba9d9cbae49b01bfc49d
SHA512 7399da6212aa2921a8ba147f10758e596da85ee8dde4aba7892ad690471977e7233986da34aa71a441c580a02b894bfcc571fa3fba8bed5b7459585c01bb21af
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlpg:WqFgqFUHx
TLSH
T128058E07E6E244FCD517C17089E69372EA71FC225620A77F2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 789KB
SHA256 60fe6696dc0277fc9c2b3b7c5b49124e7212e20f93de565e8d44ed89b2364684
MD5 20cba720f8310b960f390209ee51669c
SHA1 9b6b7d4074e45eaed974378baa0b4e08ab5391ac
SHA512 4896bda52142f517f3620cfe3fc81af2a6910cd8cbc5b4057af2479f4202f484a0796556881f690844fa002eda331261a11d7e22855c72da6c1e26fda12a19e2
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlwI:WqFgqFUHg
TLSH
T13E058E07E6E244FDD517C17089E69372EA71FC225620A7BF2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 789KB
SHA256 4b66bdb7a416acef42df8101f81492c649b758f3ab476ce3ce48dbdb1ec6ccef
MD5 e588f2a5349b54637b9a14631261abe3
SHA1 d242bb141d23afee1576786759d3d800dd898006
SHA512 ec2fcb2353c7bf766e51ea3191ae295475d07273617087fe332ca69b9fb484487bc1baf9bf6f648e616d882710d56f45894fee4966e40e58bcf0b63dc771d529
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlyo:WqFgqFUHC
TLSH
T1B6058E07E6E244FDD517C17089E69372EA71FC225620AB7F2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 789KB
SHA256 6d4ca069736d7dad113f0d38f39c4529d1cea70923fa0c1e21e453ce0bade466
MD5 82d287c3ad6c8d9ccce4e76f115023e5
SHA1 bc539a9552d06cf98cc557b64961338404492dfd
SHA512 d358233e93bf9300808e5f4642bb392c2c1f9d3fc7ad80b64aed9f3e39ad4ab99e17dd180b7bc462358b58ae9c22da9e4b99340eb0a47cdaaa43d3bb60cbce37
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlp+:WqFgqFUHn
TLSH
T159058E17E6E244FCD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 789KB
SHA256 56c863c12abb4d81c5f58506067f666bef2195c4aca34f2026e56f87895c04eb
MD5 f5dc446266cda17a35cac0a45d00b11f
SHA1 c6ad3c8fb858098e96622f8886382a7d78dc46bf
SHA512 897e7eb99e37a74aa839567c64306c611a6ae0ddacb7db746065744d7db21c9d77b2a0627885e47ab5b5412bff43652498df82e38c6a67ff47693bb5a4640fc1
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlXQ:WqFgqFUHT
TLSH
T180058E07E6E244FDD517C17089E69372EA71FC225620AB7F2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 789KB
SHA256 b5fe9d52d556c69d23c34775156857b53c857355e8383d1df1a15846d34dd566
MD5 b17bbdc0ddd5263f66e0897ee7fd03a4
SHA1 1bb9f717db7cc4157d80ab3737f7948a5b22e4e1
SHA512 b2e1a8862add33c3e7e364b184e58b83d89cc5e490740af2ddb521cabcff7ebec259a224cc0c86b8806df87db9f360e5e7a8a0d99a5fe99e393b79b27594b58c
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlsX:WqFgqFUHH
TLSH
T155058E07E6E244FCD517C17089E69372EA71FC225620A7BF2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 789KB
SHA256 760376d81e4f48cb1a0095aa9c78de169af3b6203cc1b4d973262b4abcb4f51e
MD5 5bdaccaee4d01621cf24d53491f14649
SHA1 22d1d576245b349eaacb0d269a3ebb42fd016418
SHA512 8c40b7427bfac548e8848c499e78ba01302d4b55d996760c33c2588e3650ffa1167490e45d11ae1b48b8d22f54ccbc85c2cf3efc2b9cc08c4a8dbefcb5571df4
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGlKL:WqFgqFUHp
TLSH
T1D9058E17E6E244FCD517C17089E69372EA71FC225620AB7F2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 789KB
SHA256 1700e5734b567b4d6264e5977ab24285c4b9e1252d3983c6b056708b260298f7
MD5 23f7e491182178902954ff51d729681d
SHA1 a308d5c5b456f876e05ad002284946fe7a9d8211
SHA512 ccf950b9597cd2a7f417eb5bb410a2dd743fecb7cc7db727a37b8804f4e9b61c53d5d612e71fc2ea141fed42754a4aaf28462859413c4429693f5a0eb2d84099
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGluM:WqFgqFUHQ
TLSH
T182058E07E6E244FDD517C17089E69372EA71FC225620A7BF2358E6213F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 789KB
SHA256 c8968023b74aeceef1461b5abfe4c88834d37ab174a1aef0204fdec910523651
MD5 e8c12153898e4dfceb7bb604e1d19f62
SHA1 2eccd2a705cc05676b911c4930f068a1089dc7a8
SHA512 58aa0058c5e954ca331de3b24d8b6fe42d75a4a0382a13e5c138f38bdf44ac124c28410b31f2561a84e00ec708fb688e127c22f3add36a4e49980076fbdbe10d
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSzQGl3h:WqFgqFUHC
TLSH
T1A9058E17E6E244FCD517C17089E69372EA71FC225620AB7F2358E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4192-2006-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5800-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5800-1987-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads