Analysis
- max time kernel
107s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 23:41
Behavioral task
behavioral1
Sample
2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe
- Size 825KB
- Sample260810-3pkzjsbr7x
- SHA256 03b3a4ce83a0006d150332536e6a4fb7601426ca556ad9ce61958fb93a39d4ae
- MD5 96fc2ddbe75cae4fdd0b38fc5910b243
- SHA1 9c3bf51641b7b17abc4e9d1d4d87695d80ba6a89
- SHA512 9e4a6b9e1ff0d43b8b35b054ea9fb2fe185d5f66846930a7e23c6ae3c4bb6e900e7a4f21a4824237e808b85ad2a071dab529a7e48746792d177cc2be0efeef98
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHT:EjQMFHDUT22Ca+VyCAR0iHT
- TLSH T1AF05AE51B6D084B2DA9301318CA5D7716638FEA10F2189FF3398376E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 45 IoCs
resource yara_rule behavioral2/memory/2956-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c525-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000008f2c-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2956-21-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/244-22-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b330-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019cb6-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019871-225.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-262.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-480.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a85-499.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-602.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-628.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-708.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-739.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-788.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-801.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-850.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-869.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-888.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019913-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-909.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-929.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-954.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-979.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019918-1010.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019919-1053.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991a-1096.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991b-1139.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991d-1171.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991e-1179.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991f-1186.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019920-1247.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019921-1332.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019922-1345.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019923-1370.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019924-1383.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019925-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019926-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019927-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-1401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992d-1402.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992e-1403.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b7c3-2136.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c525-5.dat aspack_v212_v242 behavioral2/files/0x0003000000008f2c-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b330-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019cb6-60.dat aspack_v212_v242 behavioral2/files/0x0004000000019871-225.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-262.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-401.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-480.dat aspack_v212_v242 behavioral2/files/0x0013000000018a85-499.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-602.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-628.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-708.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-739.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-788.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-801.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-850.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-869.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-888.dat aspack_v212_v242 behavioral2/files/0x0003000000019913-895.dat aspack_v212_v242 behavioral2/files/0x0003000000019914-909.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-929.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-954.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-979.dat aspack_v212_v242 behavioral2/files/0x0003000000019918-1010.dat aspack_v212_v242 behavioral2/files/0x0003000000019919-1053.dat aspack_v212_v242 behavioral2/files/0x000300000001991a-1096.dat aspack_v212_v242 behavioral2/files/0x000300000001991b-1139.dat aspack_v212_v242 behavioral2/files/0x000300000001991d-1171.dat aspack_v212_v242 behavioral2/files/0x000300000001991e-1179.dat aspack_v212_v242 behavioral2/files/0x000300000001991f-1186.dat aspack_v212_v242 behavioral2/files/0x0003000000019920-1247.dat aspack_v212_v242 behavioral2/files/0x0003000000019921-1332.dat aspack_v212_v242 behavioral2/files/0x0003000000019922-1345.dat aspack_v212_v242 behavioral2/files/0x0003000000019923-1370.dat aspack_v212_v242 behavioral2/files/0x0003000000019924-1383.dat aspack_v212_v242 behavioral2/files/0x0003000000019925-1397.dat aspack_v212_v242 behavioral2/files/0x0003000000019926-1399.dat aspack_v212_v242 behavioral2/files/0x0003000000019927-1400.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-1401.dat aspack_v212_v242 behavioral2/files/0x000300000001992d-1402.dat aspack_v212_v242 behavioral2/files/0x000300000001992e-1403.dat aspack_v212_v242 behavioral2/files/0x000300000001b7c3-2136.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 244 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe - Drops file in Windows directory 21 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2956 2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe 244 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_96fc2ddbe75cae4fdd0b38fc5910b243_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2956
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:244
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 825KB
- SHA256 03b3a4ce83a0006d150332536e6a4fb7601426ca556ad9ce61958fb93a39d4ae
- MD5 96fc2ddbe75cae4fdd0b38fc5910b243
- SHA1 9c3bf51641b7b17abc4e9d1d4d87695d80ba6a89
- SHA512 9e4a6b9e1ff0d43b8b35b054ea9fb2fe185d5f66846930a7e23c6ae3c4bb6e900e7a4f21a4824237e808b85ad2a071dab529a7e48746792d177cc2be0efeef98
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHT:EjQMFHDUT22Ca+VyCAR0iHT
- TLSH T1AF05AE51B6D084B2DA9301318CA5D7716638FEA10F2189FF3398376E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 468fd383a518ae521672196e67b6edc66428dabac8846bc5308a4ff8e0c821df
- MD5 60862acd8dfa22afa4a291ee278c1e69
- SHA1 e422759f293ffc85c70698d199321f80f87d8422
- SHA512 ab85d67a3d8c8752fd7075815d23db4b8aaaba3be476ceaa6b6fe23d585cdae25e9ba2ecc2b61d86f837aeeedf9c9a7be167e1dc035ec31cea25772dfd8445e8
- SSDEEP 24576:EjQMFHDUT22Ca+VyCAR0iHA0Le5ji0hmxNrM:9MVsDCAsPji0Aj
- TLSH T128558D11F6A08272D0B38075CCD2D76AEA317D910B308ADB1395B76D6F376D29A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 840KB
- SHA256 6ae6dbed454fad9a6f51d03ff11cfd2fe141d0137ed04cd2d6200e642ec184d6
- MD5 93d78441ed41227816aeae6d1341773f
- SHA1 7dc16c53d652962008f437d6758b8b5c3335248f
- SHA512 07cc62121683d95bafd53ad7e430c360388abe4210c09c2b626960dfd1b97d08dba5f06241d25ab7779804719b6d9044ad6d19b0f50f344c97dd9f0b40159008
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiH6a:EjQMFHDUT22Ca+VyCAR0iH6a
- TLSH T12205AF51B6D084B2DA9301318CA5D7716638FEA10F2189FF3398376E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 873KB
- SHA256 86a0186209665495b525530b1660e6cb67ff41fc30ab76aae788f91adc160712
- MD5 3158b81c9c4afb1a035da88ae7fceefa
- SHA1 b765777b2c0db1f6f350c9d497c315b687da717a
- SHA512 3fd2cde51c96d5f0c0b354a8c583fc90e0de46ad66e53c0a6ac039b67b8449405df49cadedb155ef3465bdb0b2ad0d9666c6b4bac5fb7bdd3f8805f485aa8503
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHpb:EjQMFHDUT22Ca+VyCAR0iHpb
- TLSH T1F915AE51B6D084B2DA9705308CA5C7316638FEA10F3189FF3398776E9E313D1AE29766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 849KB
- SHA256 ed41d299a6c976665cfc153def48ca4848d3f26db70000c5202e5579b634ffe3
- MD5 0599a1903b65aa62bdcf07d5003d8f57
- SHA1 993a9e74569a7d4536039387dcaccdf2b2966082
- SHA512 0835b0eb3a8096b5302a94bd9f767ead576e95f3da9984b8b84c87e32bef32a00e78d43838a0c61680dd1446bc0fe6661ed3c8a7b80f763c0317994dc6beaf70
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHL6:EjQMFHDUT22Ca+VyCAR0iHL6
- TLSH T18A05AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 849KB
- SHA256 c221603be6d3a92efb34f8301cbfa237d4589199e73e02ef5ccc3adf9147d711
- MD5 44c80c1e392686d9e223235d9dd844a5
- SHA1 c76a6497c272f206f41610ce9d23352982f39d06
- SHA512 e4feab8fbdfb07761458fe438537434526ddac12fab74dd59e5bf2f091f5ec06b94503583a18cbf35f724158c9635b4f4729240c353a46c137ed918918a97be1
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHVN:EjQMFHDUT22Ca+VyCAR0iHVN
- TLSH T15605AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 849KB
- SHA256 78606c03f04361a6cdbbd8ebe78917db96feec4f6f82dd227b823ff6b9143539
- MD5 61b93a6b9710de4c2eb68eeffe14529f
- SHA1 4ae4a037899384af46fbf667b5483badb10ffbdf
- SHA512 942377cbe31c60a380bc313da78007734f75491d7ad2c899f963e6101b2ee1e5736c122111e8d4af6dcedaf55581f47b765f9a09f2ceeb9ac06554a601983702
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHTf:EjQMFHDUT22Ca+VyCAR0iHTf
- TLSH T14005AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 849KB
- SHA256 c457951f5a1d32d4b64f47fad38c0a8167b3487d1e77a3109405373c58e8c59b
- MD5 3a9c4ac8fe373b1c52afeafd7f8dfea8
- SHA1 6329fe2590a68ba6c42f9347f195af8e81d3f30d
- SHA512 a00f61f8943346bd456c5f21e7192a6666f4a9e333dbae71547241bf41368be9254dcee58f4e9f316f7f05cc494d4cffba5811be3af40fa55e51ab303a959e82
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHlo:EjQMFHDUT22Ca+VyCAR0iHlo
- TLSH T13A05AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 849KB
- SHA256 7717dc5d782e06b80f109c78cd0dca941b142c2c66bb95b4c7331b924f5da4fc
- MD5 f0e7f24fb126fce50659108499c60d9b
- SHA1 0dbb58af2db6531798964f7e0785c4b404d92912
- SHA512 1eb4baec24b3d2802c059c9f2bf2fc6d69f56828576752b6adac58dff6c0236ab9293787200107c827fb49db83fd2f0207daabc06f29ce6375f91ccd48768154
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHlu:EjQMFHDUT22Ca+VyCAR0iHlu
- TLSH T1C805AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 849KB
- SHA256 9168ebeb525307b90632714333b3128babffec9d9a45128a5328863e93b4749c
- MD5 39126edbe7478b1e20e40ede0b8d3d2b
- SHA1 fadf8e6ac22e2a53a016a2d647589838c90160d5
- SHA512 65dd1b45b384ed9ab41dd552f2c9aa6cef3e81f626e046507efeb46e1c280e7e9944cab48388207e47b9f04374d95a6f8e63138db58eb75847edbc5343cf9e0d
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHb9:EjQMFHDUT22Ca+VyCAR0iHb9
- TLSH T1AA05AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 849KB
- SHA256 3c699b994984e221303e0b467d8a32d7a4be70c0bc9bba7716783f48f1413836
- MD5 a1cf3a7dd49839442af25f60ad90e456
- SHA1 e8135d2ec96a2fa8e676eaae8c9b76c24c9ce12d
- SHA512 598dccd9e480acbe1d8aa404658569e6b81436dd031b2f1fe26345930cfda8d9b3a0169d3a329f215b1b03134866990adc9b32d0b6de71f29087bfc39e24e490
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHnc:EjQMFHDUT22Ca+VyCAR0iHnc
- TLSH T17805AF51B6D084B2DA9301318CA5D7716638FEA10F2189FF3398376E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 849KB
- SHA256 7778ef32860e41fc1a4495463dea0f5ef13d2a1ba640ac04a2f4cb4bff4b5de1
- MD5 4b73bdeebe954238e7d0946ed33a0f68
- SHA1 b7e96820ba6f21e4fa36221c2ca6e0b941b39560
- SHA512 7eeb30df87a630fc914e4340baa44b51711a49237a19b1255d6c083532b76c0611dce4fb75f019cad2f0c455e962ed5163365d6b932ccad50547967ccdd54f19
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHwp:EjQMFHDUT22Ca+VyCAR0iHwp
- TLSH T18B05AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 849KB
- SHA256 3c5d22e749cfb582f762fb7882c2f2f9d7492a5dcaf2a99a29aa6727125df144
- MD5 106a1febd0912e3020c9af94151399a7
- SHA1 d3974911fa9b0f60e8566cca5a61b3a6483a39c4
- SHA512 41735e37c118d0af2a741a9cec89d5ba83f3f724be3ae9e553c94a76fd8d955434349fabfbce855f950db291f5f8291656cef5dec1557f237c8bfaf454046657
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiH30a:EjQMFHDUT22Ca+VyCAR0iH3N
- TLSH T1FD05AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 849KB
- SHA256 141467a2cfe6e1153a0062c8d553da94561f2ab29959706dc28bab038e94935b
- MD5 f380b765c6d2f15c1c6a133d81ee32ee
- SHA1 439e746c8ff9f3b57f92b48218f3a7d9de10e3f7
- SHA512 f056638b2a2152843fa67989a6aac4a7ed6647881f060cbc2d54c6d5d51a228df1001353c0f03689b7af42df156f5cc2df372119fb820155015a6763228b9a41
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHVF:EjQMFHDUT22Ca+VyCAR0iHVF
- TLSH T10105AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 849KB
- SHA256 23da5ada05dcf55d706c59b51b1ee0d2e87590aebba1467559c634312de08792
- MD5 c228001f18b29749c2f0328c0a35fdc0
- SHA1 a2e77c5a402576843fd5fd6d0346aa5c32dd10c5
- SHA512 636d66c3f51130a9a003f6d55c406b316a1c7e67fae4ea04ee58b14ca04c4e3d324765c6be8d4173fc42ead0b52d9b71f7b5ac1d1810b3db0ad01bc4ef054ed1
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiH2C:EjQMFHDUT22Ca+VyCAR0iH2C
- TLSH T15E05AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 849KB
- SHA256 1a5deaaf5b0d43a3f5e5bd3e7e781a0f2d2dcd5402ae2a68fb2950e45cd109a9
- MD5 0d5d0dda6c25a45d2f22d03007901d06
- SHA1 c888c56ebb108511f48e38d39239c2bbd54452be
- SHA512 2368989760027a9fa4977a4e355d56c44dc1fc21d0ca59d5319aec4bed16e53e88bb23ec63b8111596902ae05f905d4c0afe454fa24e756dd474671b04883ca4
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHZw:EjQMFHDUT22Ca+VyCAR0iHZw
- TLSH T19D05AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 849KB
- SHA256 f33c21052b04d8e60c8b42e1660dc7c8d9f88687ae14a4b99472059e9671cc85
- MD5 8a08e6955cbba4f3a7d1f3aae56b74d6
- SHA1 c8e070ba425458d292ad6e074d90a29c9e3d00aa
- SHA512 133c760149559f712c356015d0ac4d58f7853877230dfdc5d897bd3ae8841a6da86ce8cb27bd0f2b1891920ad5f0562741ac622da4d6c2636316817152ea477c
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHgT:EjQMFHDUT22Ca+VyCAR0iHgT
- TLSH T10405AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 849KB
- SHA256 a53b51f3db9970f38660351461a67bd4d3815c7277e4c4715885dbd9c4d6fce7
- MD5 8d050a8b9dd535920aee272e5764db7c
- SHA1 4f4d64e0212759e6eda5e19d46834ff2c4d25d7b
- SHA512 ec8bf87393c9c0596adb810bbdd95f1ab421af169889dc805d28efd3b37f27b134079ca4137d6a57b008045b6d1d42ed52f4b1eeefd997dcdbf4cb26a78df0ed
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHMu:EjQMFHDUT22Ca+VyCAR0iHMu
- TLSH T14C05AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 849KB
- SHA256 af877a63e5fd2256ef335b78482edfe9d7ea0bb8303c0a7f931b2a1fcde6dd9b
- MD5 d92317960d23d6c187879e205e59be80
- SHA1 4f9bc987f57120981cf1da2ed92ab891ee2a9441
- SHA512 0ceb40059e2faf6fde3c0ca9aaad0cce80190463cac0be149e099872ee43be89bdc67de1b88dee404caac291f018d314da0a0344574b13c3c0618c881c301c8e
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHqb:EjQMFHDUT22Ca+VyCAR0iHqb
- TLSH T1FC05AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 849KB
- SHA256 9952b7ba0b6562f16df2116abb4166fcbc23870be22be83e02d3a2bda0a8f1c1
- MD5 c462e3a6732013555fe19a304e1557cf
- SHA1 c61438832db851608641529051c7087194e025a6
- SHA512 458a2cac65d7cddcdc5fe03f6b942bfd1c802e961803df86dd10f709c2f7b6c0d851df3ef61087bda9346b6f1dcc2061d8e53bf4274d1281e288139425cb5760
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHsf:EjQMFHDUT22Ca+VyCAR0iHsf
- TLSH T1E005AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 849KB
- SHA256 2a88b0771089a6a4f10301ea81a17465ca439b562a34587e96d9d73c2da6390b
- MD5 35d2a11f16773f46bcfdb630b46e06de
- SHA1 adb980b8dc87ba6a11f879740fbe8bb7232e861a
- SHA512 fc65063edcc922897f12cb005f5dd9918ce5de60379acb7bf0016093d39067d5d01465c91645697c22047ad1ce268849357e972163856ebe5ee4e126824450fa
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHpK:EjQMFHDUT22Ca+VyCAR0iHpK
- TLSH T16505AF51B6D084B2DA9301318CA5D7716638FEA10F2189FF3398376E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 849KB
- SHA256 2b4a33c00d5cb5e6e1eecbd90792d5467ede6d7ce662372f8dd894e1df022d67
- MD5 c3298062919a8dad8aeecde025dbb753
- SHA1 825ec72b00116b871707401898ed5ff984f08714
- SHA512 1cc2b344f52e62964f51d2841a9de4dfb53d96adf3511d520a4d0db4060aaec15d98e200c2b6162d8f8c9713752f09fd719fd6d49b07b9cbdedae391c4642ce4
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHSk:EjQMFHDUT22Ca+VyCAR0iHSk
- TLSH T11D05AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 849KB
- SHA256 54bfa26947efda4e88fdcabc126739704caa5502c2c52199649793611f67ab55
- MD5 bc870c489726b59ae2198fc04b240cfd
- SHA1 17bcbc5feab1ae38913ddc2a648c547eefde4fb4
- SHA512 91f26cf553e60ce827c3ea16c81c5a70927eafc94e420cc80ea1e0ea8c62a6ec70aa4b13ceac80efa4d5f350c4bc82edb21be57e90f20212df77251cc304c7af
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHH0:EjQMFHDUT22Ca+VyCAR0iHH0
- TLSH T1F305AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 849KB
- SHA256 e9f5c050b67517bd973d4d0d513a591decab4c67918fa96bb66dcc2271cf8386
- MD5 05d11fc542f5de57e226cc53ecd3efcd
- SHA1 e641707c8e12d007df52c38d3dc28e23d47812d6
- SHA512 6078c0d4eebe325a589c5d77e915673e8f13a18e97ae75d769f6a2e63454b052db08a8230fbb9325545501e7647fe0b38e53b1d83064cd98410bc18895eb253b
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiH270:EjQMFHDUT22Ca+VyCAR0iH2g
- TLSH T16105AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 849KB
- SHA256 bc947bb6862b842d28ba10cf1c883e91dff1fbe5ab54c0c2997b147731d61828
- MD5 78f7c59dc69bccb41d53bca24be11cdd
- SHA1 fed2ccb482f74a479ee2c37078410ed736e8dc9b
- SHA512 617c4ae6d52ccbac8cbfa549ef892aff20c1da807e0d82e1f5c2a096d822751dfab7dbfb8686078dd58b8deff1a8cecb739063df08f17f8072ef6768b555aef6
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiH/r:EjQMFHDUT22Ca+VyCAR0iH/r
- TLSH T12B05AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 849KB
- SHA256 8b9d12a988b1d9a7949461a9cf323e59eb325c2c87fc0baf8c39df7d0f2bd4fa
- MD5 fd6fa22ed52d2aeaffb5b9d04b726716
- SHA1 ff09cd583ba8f035115d9dc93f79f8257af01e79
- SHA512 07aa0cf5b3d0cbb447a31c070f8dd5edb691a0cae320bda4d1d4aae753974b167e2d7c51061b1fe41b8703781f7de4153ef374d7e1892ee5d2ff396dae189aa5
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHJn:EjQMFHDUT22Ca+VyCAR0iHJn
- TLSH T15B05AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 849KB
- SHA256 673fb1c5699f5dd37f5e56338e3d7c2dc8a8a23ff7a275d601c1bb08161234ef
- MD5 c943fed029f885f7cf4bffc6bd1de6a8
- SHA1 c2773282cdace08e3be5c410448ab2b98bc73d93
- SHA512 d60a0877a6b626f8cd89b90e4a31929a104646edd6b285ed0473d6dba09e0b35a102dbe6b07a6dacc1731d370e598c4a7d1ae8efeb8cf812637394cb2f1e4c8c
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHFx:EjQMFHDUT22Ca+VyCAR0iHFx
- TLSH T12505AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 849KB
- SHA256 accf3b4b65846e94c0a9a6ade3e4d67ad0c06dfcd6d62a4c720dd6ca8c0e629f
- MD5 f83177c844fe1bef63d2f7d02d156832
- SHA1 5482a1bfa880525c06a7c7d813b6c05600ede0db
- SHA512 4ca929ae5b991aa8bc3ca9d3d001393f00f1629ec6de1ad9ea064c4b0b6db4b103a835cb7e4daaa4830099be37dca4bcb3a595f55e36b76d9db7a961544716fb
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiH7A:EjQMFHDUT22Ca+VyCAR0iH7A
- TLSH T1D105AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 849KB
- SHA256 35616bd36a9e0c05799bb893a1dbefa43ac15beb6b005381da80381b61aab954
- MD5 55383470097f48422c0d053da8c70dcb
- SHA1 04c36d6f0adf2c66799336631bc207855ba5ebbc
- SHA512 c66e54927d2686652f83409191a3f42489d851eacad4fb80c68a6daef766a0ddd744c8b9ab928e1db5e30b13b9438436a86fd49b3f5d8a58341664987c0fe664
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHs9Q:EjQMFHDUT22Ca+VyCAR0iHs9Q
- TLSH T1FC05AF51B6D084B2DA9301318CA5C7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 849KB
- SHA256 66bae5dbc01ccc9c8b72600d8eeb3dc0972ad5abf799bbbfcaf27caa79edc5f4
- MD5 9ce8a209801154de9cb1ae1a5010316d
- SHA1 c34c57809314a97c3a056887d8798d908f8d915e
- SHA512 cf7920d48eabceff1358c2b49e2a7997ef9390fb85cf04cc3ae9ab1351b3002269b4155e556bad24ed374a71171d36b2d8d3173fe6972ea4b084d3a6143b35f5
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiH14:EjQMFHDUT22Ca+VyCAR0iH14
- TLSH T1CC05AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 849KB
- SHA256 b956fa5bbb72d42e7620aebc660774d149b268c22736ffdc975e4b090916c772
- MD5 2ba3c0a12c58e72f30b3059c0575b2c6
- SHA1 f554d09a70a8fb0ef7484f6169a3ded93fd6a90f
- SHA512 9321aedd4bc319fdbcc1487a3e2061e34f33513b1b272510635484be9de6842d2c537e35112aa450aa4044efdfc41a937d8d7919e84420d3328586a833615b96
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHgu:EjQMFHDUT22Ca+VyCAR0iHgu
- TLSH T15B05AF51B6D084B2DA9301318CA5D7716638FEA10F2189FF3398376E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 849KB
- SHA256 3d8c984d70ab185d5c5c8ef6077c16da1654d914b7844cafe219b80afcbf0431
- MD5 ad463393453c40b7265a7d567d059c05
- SHA1 63ebee25c1d7bd0b467bebc3729642bea451fc71
- SHA512 6cb30309380d7a271c1c27b3b16676d18f61c5bf513f635a5f99aef2dc4ed24b7d336f05dd1c8eb130596ba030a441e8619085872e9a49427d2e2e69e1b72186
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHBj:EjQMFHDUT22Ca+VyCAR0iHBj
- TLSH T10105AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 849KB
- SHA256 79e9972c1be569aef7bd3a1f451914d4429bc48f6bd424069445beff8543fcf4
- MD5 5d14df4e55d16d49d1142207d2bdc105
- SHA1 b414b12d52bd886baec8470b6571756b20e839c2
- SHA512 2a1db1d26f994a8eec3cc8f0b5c6daa5373808ce618cbaac1788a0e324c2cede7c8adfb1b166afbf067b7f811e37a890e042dd8400263bb1dc65ce4a5deb99ab
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHIg:EjQMFHDUT22Ca+VyCAR0iHIg
- TLSH T18205AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 849KB
- SHA256 86019eaf939a70f3f777918604b82e89c5e84692980857c820235ce91b6275b6
- MD5 30f88c8534e05b5939e1e863df82197d
- SHA1 da5e79e651a3fca37d4938a9667e10107523dbdc
- SHA512 76f818556ca21bdb4da6031687879e998c9e3536d5ca51f6f8b457ea5fecd2210b2964c22de1e00fed394a17dc9985beac9ce1bc21f664a744ee95388dac0b39
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHHI:EjQMFHDUT22Ca+VyCAR0iHHI
- TLSH T1F205AE51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 849KB
- SHA256 9428c21505b3ae89715801d1a9f4f302d51aeab21190ce467ce6e488ad312382
- MD5 23e74d65832837ab7909841ed838a024
- SHA1 6de766c032184152146c79f49fe1ee4791e14140
- SHA512 5d19dd517366be6a5ec3e041f665ff2c01785c7f75ebc8d5af0d959d89c354f5e19323ad54bfc05c05f8946962dd0bb45fc19247b96351c3949021cd17a7e748
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHNo:EjQMFHDUT22Ca+VyCAR0iHNo
- TLSH T16005AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 849KB
- SHA256 7e45fd77681347e39956c517c58fa88d9a9235d232946ba6673da231b1304ac4
- MD5 bbbcdf5e26bf3c712ab52f075cc3c529
- SHA1 b207d3795d25f30cb0c4101d36df20cd9aaf1858
- SHA512 6e637bef3dae8f44a63a9be55fb9f9bdbced8e690bc1cff19b587068f8cdb3fe23d6da788e4184160c0f612d3e5c54fc8d4861a5cc3442e4e8d956604832e804
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiH++:EjQMFHDUT22Ca+VyCAR0iH++
- TLSH T13405AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 849KB
- SHA256 fadb7c3cb21ca9cc8e7569aa4127957fde10cccf1c9346e54731b988ae073d37
- MD5 6999c1f0fdd62d1a70811d97466b6399
- SHA1 3f4e03d82c9a3ccbd05b8c7cfc80562998fe8602
- SHA512 a978aab660d951c97b15118db6ca8da70e7036cc9bb580255dc5938aaff0e4c8e5cdfbbb9aca36808accc0184129242e8e348a38ccd958b5bdd3d6de0588382e
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiH+Q:EjQMFHDUT22Ca+VyCAR0iH+Q
- TLSH T13E05AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 849KB
- SHA256 c284ada85ee17f82e0aa74cedeafbfb77c128cb0e960e49e3c5ac7793d5e031e
- MD5 7c73b8733b0675af0f0e21a8e3ef45a6
- SHA1 70e86f1cd52aa84a50d0552b80c1920debb25997
- SHA512 b74a775914b057443463f5c63ba352110519ef9ce4925d58d8d0ffdedca660f1d47f651af9972879c97d145c10dd851ec14ae02a7ebc4343977b8a4f6d785e23
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHfX:EjQMFHDUT22Ca+VyCAR0iHfX
- TLSH T19305AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 849KB
- SHA256 fb1c4e940cf8b79e26557dda22d3086b3617313219a600748d1df90692c7474c
- MD5 3f9b3d9597cc0884b8eb6c44125d57a4
- SHA1 8509762d362685b8dd53a7a5ddc7da7206cd6708
- SHA512 2640fc87fa3d41df04a03d8295e61f577c49a53099424ad3f4b544d3bbdbd0429375a88f65d5a710d4018eae6e928f86ba35fd9c034f1cfd19be272495207df6
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiH1L:EjQMFHDUT22Ca+VyCAR0iH1L
- TLSH T15805AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 849KB
- SHA256 df2958021e21e623ede8a0c0bbdb076becb9a1205568e17e95ded28eeb51ae39
- MD5 77170b4cedb469ad332004141bd68c48
- SHA1 28d1bc4ab598e0707a6ee3d3a0a644e96c897d7b
- SHA512 73e2d0dcf93a54947b49e21d38b74ed345429e85db04b82fca16d13915aa96c25b4c27dbd858cd36362132193cc63cd043709c4ac55c48c021d25f76b4cab6f2
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiHTFC:EjQMFHDUT22Ca+VyCAR0iHTM
- TLSH T19A05AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 849KB
- SHA256 067ad037bd6496505f599c845b9e3a17ee612a7b145ed59a06785f496deeac67
- MD5 2cb0d8e2c9722030aba4c7ee0892a1ff
- SHA1 485dc43b300d3fc2a4fc6e0515ad2397642be743
- SHA512 ba7c5b09aba01c94c02eb6234beb98238804922245c4f9ca503175965d296ac8c87cdebf013694ac365459fd5bf1d3fa066da52904f742fea8abb655d0b08639
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiH0h:EjQMFHDUT22Ca+VyCAR0iH0h
- TLSH T17B05AF51B6D084B2DA9301308CA5D7716638FEA10F2189FF3398776E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe
- Size 830KB
- SHA256 76844c10718779a5b8b954aacf5d8c1a6f5c3ff7c040b56afa488eb57ac3a03f
- MD5 2e8936a1b213ce56243bd319fb07d807
- SHA1 1f9bfba33d4a75cb33bfe83069b9ec7294b63edc
- SHA512 bebf26f76e0afd571b39846ba59edde713fc1f9f2513bcef973f7070ff48adc654ba0cb4cc19d5efee85020159b21f5ef15439d77ee8126edcb1070c15d0b722
- SSDEEP 12288:EjHwMgsHyMqLHFZlx22CaU5rJe4VQjGARQNhiH/+l:EjQMFHDUT22Ca+VyCAR0iH/+l
- TLSH T1B005AE51B6D084B2DA9301318CA5D7716638FEA10F2189FF3398376E9F312D1AE39766
- MD5 SHA1 SHA512 SSDEEP TLSH