Analysis
- max time kernel
89s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 03:37
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
- Size 946KB
- Sample260802-d6x8rstdpc
- SHA256 07a5ede1572f6e0eacbf213447685198c7229cf7ccc8bba450cf7ad427ba7b9c
- MD5 1069baeaca2287f887e39cf83eb4ec87
- SHA1 3c36f24f8703c937dd29c3e1974ecc1fbd46bbb9
- SHA512 58a48f9fead31690b85cf8f7d63ca6443659d212f19940bd09d0f66e03b33da7a8c00cd9461a05f6f74f4789f260647a5e87a869d8976198cacf7a6dd4c21409
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPep:J/sCv7iUIxc3EEg+QLb8NVPhPep
- TLSH T1FD25391366948F71D56F053059A94261DA3BFC295F2087DF16ACAF287E307E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral1/memory/4384-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244a6-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b83-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022be9-39.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000235da-145.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202ea-249.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124c-292.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124d-437.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124e-486.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124f-541.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021250-596.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021251-621.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021252-712.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000235dc-737.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021254-780.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021255-787.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021256-818.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021257-849.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021258-868.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021259-881.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002125a-888.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002125c-907.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002125b-926.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002125d-945.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002125e-994.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021260-1037.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021261-1044.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021263-1081.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021264-1100.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021262-1131.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021265-1162.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021267-1169.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021266-1176.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021268-1237.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021269-1316.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126c-1335.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126f-1360.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021270-1367.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a00000002021f-1440.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4384-1531-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2276-1550-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002318e-1653.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000230a7-1787.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000230ad-1785.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001696d-1835.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000600000001e578-2129.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 2276 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{26DAE493-BB25-4AFA-A100-0B8EFB02FE62}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe$ 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe$ 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4384 2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe 2276 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_1069baeaca2287f887e39cf83eb4ec87_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4384
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2276
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 946KB
- SHA256 07a5ede1572f6e0eacbf213447685198c7229cf7ccc8bba450cf7ad427ba7b9c
- MD5 1069baeaca2287f887e39cf83eb4ec87
- SHA1 3c36f24f8703c937dd29c3e1974ecc1fbd46bbb9
- SHA512 58a48f9fead31690b85cf8f7d63ca6443659d212f19940bd09d0f66e03b33da7a8c00cd9461a05f6f74f4789f260647a5e87a869d8976198cacf7a6dd4c21409
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPep:J/sCv7iUIxc3EEg+QLb8NVPhPep
- TLSH T1FD25391366948F71D56F053059A94261DA3BFC295F2087DF16ACAF287E307E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 975KB
- SHA256 c1cc9af3eecb57d903931aca75367a04294b950d753e03d9315f4456f5e21ea8
- MD5 63e00f064fdd1f3340304f4076ce04a9
- SHA1 3d3da3273ab6103f5b02f6844255baff7b2d48f0
- SHA512 12b361d309572955233e54d0212a7857af562f472abe1d21dce039c848ec4cb61498de8bc96664929b4695389b60c1316af477b7ceb0a6f2191c787fb79d2728
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPevP:J/sCv7iUIxc3EEg+QLb8NVPhPevP
- TLSH T1DD254A1366944F71D56F053059A84261DA3BFC295F2087DF26B8AF297E307E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 1.4MB
- SHA256 6c775312903c5071d0591ba48837db36e1129027943b09b839a1b26f2abec256
- MD5 71733667d730bb91439ccc36590790e0
- SHA1 51629c0fd5b079a964e2c4d8a9c7e85709b07344
- SHA512 ea8b5ce60db6cb925b1427bd70e24517b0319c322a03360f8cb57a831cf3fa89fe6f4a35958ce313359862ebf101cb231f6a1f887835fb429f98ca1593e4937f
- SSDEEP 24576:J/sCv7iUIxc3EEg+QLb8NVPhPeBUr2d29dBrtpDiI:NG3n+C8NVyUidGl
- TLSH T1F0656C13B7944BB5D06F453089A94251DA37BC150F2097DF12A8AF293F32BE16E39B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
- Size 1.4MB
- SHA256 dab838565084fc725db6831a8d3e28f3a257f9652950f84ee748e98338680a19
- MD5 623123185fc207b63295ab80574693da
- SHA1 8f290bd1f944c2bf4f27b865ded0155207ea28c8
- SHA512 05acfddd02303d5b15a8a5d6fe1fa21dab61075d5cf2f6f85f54c26f40a0b57946bb70e2984e53316684a72786a85c1ff0a39a1f379be9eb6fc077147e693251
- SSDEEP 24576:J/sCv7iUIxc3EEg+QLb8NVPhPek86n9kAJ9tA3L:NG3n+C8NV5T9t2
- TLSH T132656B03B7944BB5D06F453089A58251DA77BC250F2097DF12A8AF293F32BE16E39727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$
- Size 1.4MB
- SHA256 6c3d01a8fbe5a46bf5210b4c47294c7c0d581505889163096cce399184c266af
- MD5 d5e6abe3860f4fa96c4b0c555e187759
- SHA1 73761caa85df29b9dcfea99a0c8955a5e9c0c4fb
- SHA512 c8eb8330780c1bd3f2a83abfaa44720e96a26665b60fc2b7e8c293648892f00b3df962ae70435f16288466a55946132132676a0819c7f005fe7f7b6295bae8bb
- SSDEEP 24576:J/sCv7iUIxc3EEg+QLb8NVPhPeTTjx6n9kAJ9tA3L:NG3n+C8NV8A9t2
- TLSH T1B0656C13B7944FB1D06B453089A58651DB37BC250F2097DF12A8AF293E327E16E39B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe
- Size 1.0MB
- SHA256 b3db49f5b180b0f7b245a57d85658fb442c41b411d366ee5134d49ce3da16fa3
- MD5 9094740ee803f7213637e65686ddcc5f
- SHA1 420e7996d19b18126c4de23533fcaa7964c04f29
- SHA512 e6260e620b6ae541899a2d6f9e7f024f2bbcdc971351b487e55f040798b80484dc2be42bcd4bdbb051c2cef658a1cb72de9a00adaf4212d60c486864099062b5
- SSDEEP 24576:J/sCv7iUIxc3EEg+QLb8NVPhPeJUwjBXG:NG3n+C8NVVwFXG
- TLSH T17E354B1376948E71D56F053059A88661DA3BFC255F1087DF22ACAF293E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 edcd78cf91194ab1e0dd39d7168cb3d96cb36148da0f97d8ae5c2738c9ae6ee1
- MD5 0b62f2fe05d11854e112bd364dd8ae38
- SHA1 cd859c1b179ad2cc2887a37b3009e759bf90d499
- SHA512 65148bb3bab96dedd28ab7ae8cc8d99929082d38d8ec55003a6d4d3c8c49152f1d95cb276706e2ae9e34a38789b7fb22e4ffb8470f23f46df1c1b182b51514f0
- SSDEEP 24576:J/sCv7iUIxc3EEg+QLb8NVPhPeV0Le5ji0hmxNrM:NG3n+C8NVGPji0Aj
- TLSH T17C655B17B6A48B71D07B8074C5E59656EA337C150F3087CB12A9AF283E327E1A939737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 961KB
- SHA256 e7879d7557aef10faa5cfd7362b13c67f2be3f7f0170bcde0a686d1a60d20bad
- MD5 d331b230c5a37f2bf2ec8b2a3890d62f
- SHA1 712ee9d6e8d8cd997d1447161cc669b9d8536f33
- SHA512 dc56e7e9198b69149e5df6a0dee44479d079ef35bb5dff85a6bf6df5359bfc605b177cf5aab3a1f1318143c093d87d81ab8d61bd72eadb492bfe241ee2254edb
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPe3a:J/sCv7iUIxc3EEg+QLb8NVPhPe3a
- TLSH T17A25391366948F71D56F053059A94261DA3BFC295F2087DF16B8AF287E307E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 1.1MB
- SHA256 814fbb618eb74b5932ef5e72ef9905d03ac5e02920f8dac2d78c1f65ee42e729
- MD5 266c34338b90d0c7e4a3459c2d56c83d
- SHA1 5257135a491f4fc0bd0a34dde0d1533e73834b43
- SHA512 c5eb517a04aa853889db6a42bbaff49475352ff89df12ca01b9b74edb2c6e09b1c67557e47c04d7f230e4eac1d16a226953e1b6a47a160b8c0606207aad089d9
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPeHXsf3z:J/sCv7iUIxc3EEg+QLb8NVPhPeuD
- TLSH T1CF350616E6944A61D16F0130D7A94251BA37BC255FE083DB12E8EE3D3F317A069F8B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 970KB
- SHA256 1c7531ee81624aa0a813f4506b434e0328e5f70498078bb683dda94394f09740
- MD5 344fd7d17c8838d40244eec27328e743
- SHA1 c6a5166a035b08df3abec2963b6d735c08123388
- SHA512 f24011e2f5b3675fbd4dc1cf124365ae81a7cfe07fcc18fdf024f31ca50719d20b160d12e69e34d09d5c547796bd0a93e1878787fae93baa8d3ed8e127ea2c77
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPe26:J/sCv7iUIxc3EEg+QLb8NVPhPe26
- TLSH T13E253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 970KB
- SHA256 ada47401ea06032626fc005a2c7863d64e8e9a387b3f74f7ff5015c4da42321d
- MD5 e695023f48015195f484e3fa6cb9a5df
- SHA1 66dd61befee4eb3a3a40daf7919e526d3c21d48c
- SHA512 16abd729585781ad1a55e64bfccd1ca7a27d0f1b903b562dde47bea1a621aa9ba983aec8939ef3e1df51bbff23fd3a3d3d014f6b2a9d3763251d0b758799baf7
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPe29:J/sCv7iUIxc3EEg+QLb8NVPhPe29
- TLSH T163253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E307E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 970KB
- SHA256 ffd8aebab7cd9cd9e31628132569ce40c801d6477e6415626aac310a01b8942b
- MD5 4507bbb5cc488ff6bd004b37025638b4
- SHA1 8769255a2237bd282ba901de047fdfaa2f11fcbf
- SHA512 6f5ad42526bcf69b3cb59c21cb2cc91ea6c6b7055213c7441a802fa44e380988768e6c3d62a7ab9d13f120e69195a7648c688112b953e0d652951bb675695d9d
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPe2c:J/sCv7iUIxc3EEg+QLb8NVPhPe2c
- TLSH T10D253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 970KB
- SHA256 e11126b26699e605f23cea9fe1c986a3196895031df1f31ae691ac2d5262e352
- MD5 4e0c77183b21ac1164f60decdc06c347
- SHA1 c734c3d064400fa689349e5cfe0657776eae6451
- SHA512 e44bd1de1eb0f8d657a99c74713f1329a2ea973baefcfc1592261b582689db904f955453e2dff89db52d0a00593287917e6a5df796db8f81d36ca6868373db8c
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPevp:J/sCv7iUIxc3EEg+QLb8NVPhPevp
- TLSH T1BB253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 970KB
- SHA256 d1b4b6f894e593e9027a1b2f20a818c8b3f29e39f1212509fa08ca496fcf6eaf
- MD5 764b2e6f79ae5e7e589d087b39a3b9b7
- SHA1 865ff5d7e5ce0e4e5b1a735bfec673de22eeef27
- SHA512 1f21108f37dff74978362710b1c4267c8da8fd356d8011d718e7ad66e1900ede4d97234d71a561b61b4eb2b83d061940feb29cf4bece66e6d0bd06a1c8949fd2
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPeQ0a:J/sCv7iUIxc3EEg+QLb8NVPhPeQN
- TLSH T119253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 970KB
- SHA256 b7ccceb5f94ab248cdae8a9dde98a80074ff640277391e49238996ac82e2229e
- MD5 3060465f327cacaca42bcd7c415ebb15
- SHA1 007228f9bca10659f48fd6f8bfd2f89414492361
- SHA512 562d06d41a34c97f69affabe7c174fdd48b229166077e372dac6c26322a7e98a3d4dce92305eed1a9764d88dce915edd9c9dc7901e704c65bf72446bd758c61e
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPeYF:J/sCv7iUIxc3EEg+QLb8NVPhPeYF
- TLSH T1B7253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 970KB
- SHA256 1983a7e000d27576d8de17733d7155cec0b0ce1b38b72754649c17be5776cbd4
- MD5 5b0bc1170b6c3fafad2c65c15c9c381b
- SHA1 5620ae12e2e9ca9e95c1c2a662d5dfe917570baf
- SHA512 a1671cca19b4d51148ff2da377bd80e59edf889319183ce0f9d1d5f61e5d5add1a67f264c7e7a8ca513b25e8b4fd87dec6fc8473eec522f269522fb173145175
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPeNC:J/sCv7iUIxc3EEg+QLb8NVPhPeNC
- TLSH T193253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 970KB
- SHA256 ffbdbcddd8a8b1861066c056e84616781b85379d791e33ee067b92f92eb5e344
- MD5 eb562411a6a1092ffb874a250dc9b722
- SHA1 65e1d3748133da513abd8c03f58a146e33c1480c
- SHA512 d4be372b10c91135d5ec286eaf301e959f4ec94583456a872370db60023d6752519efd4de9b3425b20c3f28d56b9691475f768c4a369e171f88dae1b0394a254
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPe2w:J/sCv7iUIxc3EEg+QLb8NVPhPe2w
- TLSH T1C4253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 970KB
- SHA256 45d687d026e86dab28c1c5c95400df529c62cd7ae47c1720fb14dfd05ff39d11
- MD5 cbbec0ceb5f0439c3ccfc14b0daced25
- SHA1 7a329eb81074434130969904b00e19838d543134
- SHA512 22f1c98bb03bbcfb907a3e62d0e00bbd52fb3493b66cf8dfd934ad84f5fdc4644cc1e388232ae3c83d80aaf16463f9e1b4d0798bfd04acb6aa12e9115b91f7d3
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPelT:J/sCv7iUIxc3EEg+QLb8NVPhPelT
- TLSH T166253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 970KB
- SHA256 ebb889a8e7468575d27fb2a98998e686600327a178afc37ba59da5d8818b69b1
- MD5 6031b0e6bb8c3f099955ed40b0e2d6da
- SHA1 e985be503fff677d7d7c97c2097b4e733f9526f9
- SHA512 89d2861f358ed670d0350e16b93fc4f22f3e14335c80296f5ff1f6b201f2b7a95f0ef70f6dd2216c362aac5eb1a84308e0cdb4e829452e13997e30f2e0584ae2
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPe7u:J/sCv7iUIxc3EEg+QLb8NVPhPe7u
- TLSH T13D253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 970KB
- SHA256 827d83bc379f217bcb1ad270700c28e12ef540bf19617f6c4e5f1042dbd08f1a
- MD5 53c1a16ce33a2186792befcbccc7133e
- SHA1 9e4a8e02d7d89d8cd9dd0e03b16aa266ce4ec935
- SHA512 14badcf06a64580e2ae2375bbf3d8e2df2719d14dc500e68d66f06c1fcbeaf16d39f8e55e1c27defe6e32b264aa80d2a82723cbe728f750ac30e38886709d066
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPefb:J/sCv7iUIxc3EEg+QLb8NVPhPefb
- TLSH T1B3253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 970KB
- SHA256 24b53bd680658b21994c05323bed16949a44230d259073cce7521f7e07ae5072
- MD5 8e1997317153ab987bf6e5af58175a0d
- SHA1 e533045282c4a4076a400440231147386294c083
- SHA512 c125e9b13723314b8c89350fb3c7139e2978a82dd2bf4fb0a875e1f140b259b3ba3afd49326b14ed38d2c025a4abf8ab14e893c3115c5c4f58bc2fd698bdb928
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPebf:J/sCv7iUIxc3EEg+QLb8NVPhPebf
- TLSH T167253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 970KB
- SHA256 cf6072327311f33e5f765f8565ecb8576f749645361d566cfa4ce7b31fb04129
- MD5 204970c96b404dc0d17e56fb2998ac11
- SHA1 eee8d966b88302c9f5584a3344f3afc30b5e7c63
- SHA512 95c41d2997146de26be42b81189007c5dbf03d18f24e67694c21171555826fd7537f54649498915352a90cb656ba4b7de773b8b4dbb4c7cc8a44e6cd606504ac
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPe0K:J/sCv7iUIxc3EEg+QLb8NVPhPe0K
- TLSH T1A4253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 970KB
- SHA256 96d235fdc5f68699c66264ce87d1f7453b8109c2f1aa8bcf034ddfaaa4a5e239
- MD5 ebbaa642da6177ae1523c86dc8ff6be8
- SHA1 3f712f0a607eee766e1e9a2e8ac6bdc03b90d4f5
- SHA512 043ff31b578c6992b9f1b5686331d4951a4338d8a76548be18b0061cec5716e4f55a9983299eb323b3dd9aaac800cf7525ee16bc748511ed1f80f7d66acbda05
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPepk:J/sCv7iUIxc3EEg+QLb8NVPhPepk
- TLSH T1B1253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 970KB
- SHA256 8a48b4faff8816f1b046c369501e9bdaa8b19984657c946bafa44809d9d65198
- MD5 649de745f67bef8c4cc1503797e5eccd
- SHA1 700bb24183b5af70c74d19c2646a5e50f27455b7
- SHA512 5e3f40339970a88eb936a0d68dbdec786ad45c468d637bd2090f5acd55b46609a00f006f84f4fbb94ec145508785100f3539853a429c3fd9dc92ed3705a8357c
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPeG0:J/sCv7iUIxc3EEg+QLb8NVPhPeG0
- TLSH T198253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E307E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 970KB
- SHA256 c1744ad3584d7601876b916fbca4177a03304acff8c8853b58887dbce6583647
- MD5 b46476f2faed9e86ed290265332b188b
- SHA1 fb21296c6972ddc6a7ca7463b374a52c309ba414
- SHA512 b6da91b8e84737f653b40c321aaf474197b8179aa6c366055c161c0d6f534f7e313af580600300c1fd1d6dea4d79b36eb0e8b094753957e271697249a60eaaab
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPeV70:J/sCv7iUIxc3EEg+QLb8NVPhPeVg
- TLSH T16D253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 970KB
- SHA256 b698a599b338e0a78d142eb176ea7a072dcf18711bc2b514961513691d6def79
- MD5 a6d0a5d1d4260f482caa8ead618033fe
- SHA1 ad5527efbda05b1f81e1ba535647f510e28e22b6
- SHA512 c9c9fadbd5297a67faab63765b6f7af27077bed6940d42fd47e749bdef299436e3f9b9bdd997bd9d59d1c945f3779f9bf17f360f2b76b8b79c8867901c44808e
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPekr:J/sCv7iUIxc3EEg+QLb8NVPhPekr
- TLSH T1E5253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 970KB
- SHA256 538908689aa7a7b30b5af8cf3ba684b89f2a5acdfe32c5f9c89f8fa112ec5c74
- MD5 edffd352e65fe6fefd27c4413c2f838b
- SHA1 4a5ddbdee66ba6edb4b7ec398bdc208336b4fcb2
- SHA512 1f0738422e0c6f7fed68f3efbbab3ac398af5867e20e2fd4b89240e8e6f065bd08a04ca14cb861126e6e17edcd344ae30d30ed813f8ad6ff70a846707147eabf
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPe6n:J/sCv7iUIxc3EEg+QLb8NVPhPe6n
- TLSH T18F253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 970KB
- SHA256 c3c5f92c6bd01aaff5663282f90b7c49caba12ebb9d2fb02c78941452572a032
- MD5 1a842868dc5e6146126aa680ed5b3b2c
- SHA1 ac9af6fd820f2fdf3634233f958fe05e486a1e7e
- SHA512 b0a243628b5e3efd617643d4e2ad775a7fa930b077ea5185543772a86ee4ef24c982ccb32d540ecfa2fbe12e5fc097098c6f30d10f8132c855667e90009d6453
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPeQx:J/sCv7iUIxc3EEg+QLb8NVPhPeQx
- TLSH T18F253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 970KB
- SHA256 2c1a9062c11aed776d3446b0a1b107ddcef843030887357885260c11d6c74a1b
- MD5 64c475661227dba1ae843909f1f25dcc
- SHA1 8641811268b25eec48883d3d777aa909495d987b
- SHA512 af8c8092c9d0deb78f1155db38fff21403bac9839283a8406ac16ccab6695c159a8eb7aef0bcd3f86bc89130cad628181a60c4bd96afd3179a4b5be3a0e36c0e
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPeSA:J/sCv7iUIxc3EEg+QLb8NVPhPeSA
- TLSH T1C5253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 970KB
- SHA256 bb208071b66d27c7da2ca931f52d0c8902564aeb63f7c3b33f1dede7eb00c056
- MD5 ec2b821522c24273fd12e03096876857
- SHA1 da94de2def6d83860ff85c7c86ee2ca19ad4971a
- SHA512 a0f9f8684bb096338b5a8d745e9cdb45c253975bc3f8aa0e5774bd98992b9cd5b9458deabd06765f5547aef3f5b8758a982b14dd0a8dc3a31df90284b4b5be2a
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPer9Q:J/sCv7iUIxc3EEg+QLb8NVPhPer9Q
- TLSH T132253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 970KB
- SHA256 269f6c3105965b9de22da719ded60c4ac530e4edaf693242c0377e056c9597d5
- MD5 450a20c6e31a3339f424e9893d4c6223
- SHA1 6120eb9dca86056db88fa945f6bf0a9bd50e2c70
- SHA512 9a1a964dc4ec643c6545e8350a93dbe498553feef81efea6216c501a506c4a1be35ad14de0bd452d19e8f3f90731b1d0ff5f91d7449ff7bb1a5c5b13fc94ffeb
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPea4:J/sCv7iUIxc3EEg+QLb8NVPhPea4
- TLSH T123253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 970KB
- SHA256 35060dab701737068c7d86e39e372a48e4724e9d11541599ce52f4bd3f94bc01
- MD5 440623ae1f4200dbf06673df22db3740
- SHA1 189c1aec4b578523d512cde7ec5cace5484dd6c2
- SHA512 0dc81029b69db4bb4159a5b13c7a4ea5f689fecb470fb6c80d1ad1532d4dc90accbc0cb3a60746b3feebc3928eff39bee9e0e558b940cc46124233b9a5813530
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPeBu:J/sCv7iUIxc3EEg+QLb8NVPhPeBu
- TLSH T14D253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 970KB
- SHA256 aa4422ff2d4cee6b9665ca6b1c90e795662ef7fe8a7d95940ce6906d41aa4553
- MD5 e6ff73e4cd1ba0029740fa07db25d1ab
- SHA1 6f4a4f65eb66c8fe812715311343565ecb74410b
- SHA512 ca6244b4e62a182331c28d5c1d3100380da7f3abe581744921d9df8c40cd39b02cfb8b61cd1ca7dfe88a6d8473e24f20c11fac2330f29754c854bffd90f0951e
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPe0j:J/sCv7iUIxc3EEg+QLb8NVPhPe0j
- TLSH T1DC253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 970KB
- SHA256 44dc19cf047fb8d9f0b2a539a3953341617172e7dd42142c44de41a44762f0a6
- MD5 29b42b35ef2273b28f15be9e53bd2d64
- SHA1 c01a1848e2751b89f0f469306767137616443f98
- SHA512 8fe509cbe25ebb44a1a9f2c22dc9aa66839d6a70b711d2d78a13bcac9a2abb8e0641bc7f2934aea034bfc470016135b845cb9347406d969cc89d6dbba09de782
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPe1g:J/sCv7iUIxc3EEg+QLb8NVPhPe1g
- TLSH T1C4253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 970KB
- SHA256 f3a8f775380c118d0e06f1b6a6a31d10c66a155270fcd0a8920d0bf2161f546d
- MD5 d60117f6b296cffbf4f0a1747743f4a1
- SHA1 297e6816a8296c3774ffa9a92ec64e8a0da57cc2
- SHA512 bdf3c27f9473b0a9712137d33be093598c4ddf7f5db47a0805d18b264faa31c0e34e6423415365455bce3492ba1a69f58c2a4ee8f36ab7b685ae6e64877db4d2
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPe0I:J/sCv7iUIxc3EEg+QLb8NVPhPe0I
- TLSH T1C0253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 970KB
- SHA256 2e96cd063493ae5b39922ede0741e8039223449ac46c38a0eb5ee3caa92271a8
- MD5 39ae6c21588ef7b2e1736a8601e7d6ac
- SHA1 e80591653e17dab01c1896c94414ee8ee8308c0a
- SHA512 b1beb7e630d9873b82526a78f18704c627addb053c5d1bac11291a898b0b06ac005fd6e98dfec1ceeba878f27b09691ee19886228e5b4b69426564381e3bd06b
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPemo:J/sCv7iUIxc3EEg+QLb8NVPhPemo
- TLSH T10D253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 970KB
- SHA256 4479096f65e9697883c413d706807955d7ea680beef8d983f0069061f3017566
- MD5 487a305cc2795306e3d2a45d0dc2820b
- SHA1 ec9042a14bd5ee0eb8ff5f514bc960da5a6ade1f
- SHA512 4bb3554d6178520331ba01fda56bf50d577c6a8a66571766ee5db4485a0c42bbf3a38115ee18f2eeb4009975d3881144b8fcd3d7fdb817f4d76c8ca82d0387f1
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPeN+:J/sCv7iUIxc3EEg+QLb8NVPhPeN+
- TLSH T199253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 970KB
- SHA256 68bff7b987aadb29440a94426185c258dd6d0534ad60e4063834a871ece9234d
- MD5 7715fa9d31734b31e960b4edd3e81eca
- SHA1 a66d70520bd8df8b02f691740930bf8320adf305
- SHA512 4c33cdc41eced205ae3c404165afde839d682465605c2cead6077d7c86f31982ecbcd85f971af7646b7f13e17f1444d7035348f7cc63e8f40fae0e6f94147a34
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPe7Q:J/sCv7iUIxc3EEg+QLb8NVPhPe7Q
- TLSH T1E1253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 970KB
- SHA256 d9f3f82e9e4f6c615f2c9e584cb2e4c22035ca4fda8196fe9ef2b8385574df13
- MD5 870d0209ad5d2bf52bfe2bc0c7f9e8ab
- SHA1 586c8f652ab5bd8bef207875cd94ec08a9e052c9
- SHA512 5feef4e92d940adb2d8128ef7f7b0ff6baa0dd88a1749c55b894fba8c6f37f4d67fc0f7cd26ad41e9aacf0f5c3a0ee04265176b4d7e53c2e70afe7c888a1507e
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPewX:J/sCv7iUIxc3EEg+QLb8NVPhPewX
- TLSH T1A3253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 970KB
- SHA256 ffaa09312c883a70d66d4734b76a1af12da0bd26ce046ddce659fdfbccac3707
- MD5 2cbee0ddb0ec3fca88add14c5e0ef0d6
- SHA1 c317cfa174d00fc916c1aace8cc0b687de848b4f
- SHA512 2c72204889871dc379fc804687b037c19546509462407983f1597453a8ec0c7e0388ca2888e71b357177d9d2d4751dfa990d2009aa478a93f68cef3eceda32e4
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPeGL:J/sCv7iUIxc3EEg+QLb8NVPhPeGL
- TLSH T11E253A1366944F71D56F053059A94261DA3BFC295F2087DF26ACAF287E307E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 970KB
- SHA256 bcdb7a63fb5ac0b8b7df40b1ef6708bfdb2532bc8f166aa4043e250873a224af
- MD5 142b48adae894e7ea41934ebecf46ace
- SHA1 dd9b76f5a4d3e168cefc68878ffdcfc1524b9fb8
- SHA512 dcc2308945b71d48bf5efa49906928ece10e31882c340783ab1bd9a91c30d550e241839d26d772927e50730aee1f26afbfb9e354640a5ae977612879fac37d23
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPeaFC:J/sCv7iUIxc3EEg+QLb8NVPhPeaM
- TLSH T1FA253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 970KB
- SHA256 921e908b2b8843e49a358c904fa915a566ffb559aaebb87d022ee329abffb669
- MD5 19f1b8aef4abcb5526476ce198946ffa
- SHA1 9031faff5ab987d919bf7b2fda1e5c60d0e69698
- SHA512 a8a803cc5a49e3b2b4dd1163c86e25c5c4a661a521530b7e59d6f448ff07d58773705d7f32ac5021dc41bf7ef3dad261c0a95ca0a549935ed303ffbd07c546b8
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPeLh:J/sCv7iUIxc3EEg+QLb8NVPhPeLh
- TLSH T155253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe
- Size 1.1MB
- SHA256 852238cb9bcda10731b9ef5675320fede5b25fab3bc51957a0d7badac2393968
- MD5 ba6ac947d4785629294d80e1d0170d44
- SHA1 ef73239f683ea8ddff92450c4a5d5eec6151eafe
- SHA512 257287fdaa0791c2b0930169f05e0a8da7081241bcb29d7fb5a434db5a6264d3622325f0b032cd4f22580575b750a2a291d7f5c66475191086c26a611d064ccc
- SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mhPeVrHPgiFgE:J/sCv7iUIxc3EEg+QLb8NVPhPeZIiG1W
- TLSH T123355C1377A44F61E16F063059B942119A7BFD251F1083CF16ACAF693E31BE06939B2B
- MD5 SHA1 SHA512 SSDEEP TLSH