File name:

2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader

Full analysis: https://app.any.run/tasks/997f56bf-339f-4cf9-9118-dc45e4598a35
Verdict: Malicious activity
Analysis date: April 18, 2025, 04:26:44
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

8C8BADF634F5C15D5AEBEA34D2233F50

SHA1:

8CF8EE9269D04BD5DBCDFA8A49024F25A46714AF

SHA256:

5387A93FC5BD4D316D29DA5E3E05607EEC6C0D97BFA36E76BA1D4880F4DFA998

SSDEEP:

49152:dTdgMIISYUnUu4O3f/HAzruQfZt8lW3mUbzDJH38:RCMlSYUnUu4O3fSfZeW3VXd8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • FileCoAuth.exe (PID: 7448)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe (PID: 1164)
      • FileCoAuth.exe (PID: 7392)

    • Reads security settings of Internet Explorer

      • 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe (PID: 1164)
      • 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe (PID: 5892)
      • jp2launcher.exe (PID: 5728)
      • FileCoAuth.exe (PID: 7392)

    • Checks for Java to be installed

      • jp2launcher.exe (PID: 5728)
      • 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe (PID: 5892)

    • Reads Internet Explorer settings

      • 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe (PID: 5892)

    • Reads Microsoft Outlook installation path

      • 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe (PID: 5892)

    • There is functionality for taking screenshot (YARA)

      • 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe (PID: 1164)

    • Starts a Microsoft application from unusual location

      • FileCoAuth.exe (PID: 7448)

    • Process drops legitimate windows executable

      • FileCoAuth.exe (PID: 7392)

  • INFO

    • The sample compiled with english language support

      • 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe (PID: 1164)
      • FileCoAuth.exe (PID: 7392)

    • Checks supported languages

      • 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe (PID: 1164)
      • javaws.exe (PID: 6712)
      • jp2launcher.exe (PID: 5728)
      • 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe (PID: 5892)
      • FileCoAuth.exe (PID: 7448)

    • Reads the computer name

      • 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe (PID: 1164)
      • javaws.exe (PID: 6712)
      • 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe (PID: 5892)
      • jp2launcher.exe (PID: 5728)
      • FileCoAuth.exe (PID: 7448)

    • Process checks computer location settings

      • 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe (PID: 1164)
      • FileCoAuth.exe (PID: 7392)

    • Create files in a temporary directory

      • 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe (PID: 1164)
      • jp2launcher.exe (PID: 5728)
      • 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe (PID: 5892)
      • FileCoAuth.exe (PID: 7448)

    • Checks proxy server information

      • 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe (PID: 5892)
      • jp2launcher.exe (PID: 5728)
      • slui.exe (PID: 7540)

    • Reads the software policy settings

      • 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe (PID: 5892)
      • slui.exe (PID: 7540)

    • Creates files or folders in the user directory

      • 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe (PID: 5892)
      • jp2launcher.exe (PID: 5728)
      • FileCoAuth.exe (PID: 7448)

    • Reads the machine GUID from the registry

      • jp2launcher.exe (PID: 5728)
      • 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe (PID: 5892)
      • FileCoAuth.exe (PID: 7448)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (49.2)
.exe | Win32 Executable Delphi generic (16.2)
.scr | Windows screen saver (14.9)
.dll | Win32 Dynamic Link Library (generic) (7.5)
.exe | Win32 Executable (generic) (5.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 29696
InitializedDataSize: 29184
UninitializedDataSize: -
EntryPoint: 0x80e4
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
7
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe javaws.exe no specs jp2launcher.exe filecoauth.exe no specs filecoauth.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1164"C:\Users\admin\Desktop\2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe" C:\Users\admin\Desktop\2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5728"C:\Program Files\Java\jre1.8.0_271\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_271" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMjcxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMjcxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzI3MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8yNzFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzI3MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfMjcxXGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF8yNzFcYmluXGphdmF3LmV4ZQAtRGpubHB4LnZtYXJncz1MVVJxWkdzdVpHbHpZV0pzWlV4aGMzUlZjMkZuWlZSeVlXTnJhVzVuUFhSeWRXVUE= -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZhC:\Program Files\Java\jre1.8.0_271\bin\jp2launcher.exe
javaws.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Web Launcher
Exit code:
0
Version:
11.271.2.09
Modules
Images
c:\program files\java\jre1.8.0_271\bin\jp2launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5892"C:\Users\admin\AppData\Local\Temp\3582-490\2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe" C:\Users\admin\AppData\Local\Temp\3582-490\2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe
2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java Update Checker
Version:
2.8.401.10
Modules
Images
c:\users\admin\appdata\local\temp\3582-490\2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
6712"C:\Program Files\Java\jre1.8.0_271\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdateC:\Program Files\Java\jre1.8.0_271\bin\javaws.exe—2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Web Start Launcher
Exit code:
0
Version:
11.271.2.09
Modules
Images
c:\program files\java\jre1.8.0_271\bin\javaws.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7392C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe -EmbeddingC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\19.043.0304.0013\filecoauth.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
7448"C:\Users\admin\AppData\Local\Temp\3582-490\FileCoAuth.exe" -EmbeddingC:\Users\admin\AppData\Local\Temp\3582-490\FileCoAuth.exe—FileCoAuth.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDriveFile Co-Authoring Executable
Exit code:
0
Version:
19.043.0304.0013
Modules
Images
c:\users\admin\appdata\local\temp\3582-490\filecoauth.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
7540C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
11 634
Read events
11 594
Write events
25
Delete events
15

Modification events

(PID) Process:(5892) 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\JavaSoft\Java Update\Policy\jucheck
Operation:writeName:Method
Value:
jau-m
(PID) Process:(5892) 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\JavaSoft\Java Update\Policy\jucheck
Operation:writeName:LastUpdateBeginTime
Value:
Fri, 18 Apr 2025 04:26:54 GMT
(PID) Process:(5892) 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\JavaSoft\Java Update\Policy\jucheck
Operation:delete valueName:LocalFileName
Value:
(PID) Process:(5892) 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\JavaSoft\Java Update\Policy\jucheck
Operation:delete valueName:InstallOptions
Value:
(PID) Process:(5892) 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\JavaSoft\Java Update\Policy\jucheck
Operation:delete valueName:UpdateDescription
Value:
(PID) Process:(5892) 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\JavaSoft\Java Update\Policy\jucheck
Operation:delete valueName:UpdateTitle1
Value:
(PID) Process:(5892) 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\JavaSoft\Java Update\Policy\jucheck
Operation:delete valueName:UpdateTitle2
Value:
(PID) Process:(5892) 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\JavaSoft\Java Update\Policy\jucheck
Operation:delete valueName:UpdateMoreInfoUrl
Value:
(PID) Process:(5892) 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\JavaSoft\Java Update\Policy\jucheck
Operation:delete valueName:BalloonTitle
Value:
(PID) Process:(5892) 2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\JavaSoft\Java Update\Policy\jucheck
Operation:delete valueName:BalloonTip
Value:
Executable files
9
Suspicious files
3
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
11642025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exeC:\Users\admin\AppData\Local\Temp\3582-490\2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exeexecutable
MD5:00D43AFFB8E12569A341EC4E86FE07D7
SHA256:2228007A6284EA84BBFFFCF3C31CA081771F14F4BB94B865D6C2F5DD0D1EF1C2
11642025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exeC:\ProgramData\Adobe\ARM\S\388\AdobeARMHelper.exeexecutable
MD5:C2A0798C0FADF00C7A1F374A31012152
SHA256:9D0BBD67B2CF12AD6B0C5A781377F8A858C71C6861D2C04E4D8DA5E48D0CCBE3
58922025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exeC:\Users\admin\AppData\Local\Temp\au-descriptor-1.8.0_451-b10.xmlxml
MD5:A171AD503E5FF3810E3D50D8E99F5C4C
SHA256:2432429D010EB4BDC79540F489B61A2AE6C042DC1ECE1BA6E034E0A8B1EAAC29
11642025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\OneDriveUpdaterService.exeexecutable
MD5:32C1CFACE596E114A37E9A39CC678BDA
SHA256:724D6AF89AE852CF8E19E10E54B533F1304F42DF61B73E3BAE752AB1687AC0C9
11642025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exeexecutable
MD5:EA16990673CB3198617430BD8ED90960
SHA256:17512B1DC73DDE13508659E68EF8463FACE5870FBC5FCF19790F7B452711BCCE
11642025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileSyncHelper.exeexecutable
MD5:DB186E9339BBD1D5793A0A058E6A1B4F
SHA256:22AF3E0CC6DF92A3267290A9462CF9B952E4F0D752B73722B26D63797B65998D
5728jp2launcher.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\83aa4cc77f591dfc2374580bbd95f6ba_bb926e54-e3ca-40fd-ae90-2764341e7792binary
MD5:C8366AE350E7019AEFC9D1E6E6A498C6
SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
11642025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileSyncConfig.exeexecutable
MD5:0F27A0A9CD3BD9796B73BBB50E2590FF
SHA256:E0BD73EFACD6095FCC1D7DE8F97A71505879ADBEE626278D32510520B98C7D34
7448FileCoAuth.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2025-04-18.0427.7448.1.odlbinary
MD5:7527CB19AB1EA1DCABD3FF268A253806
SHA256:5FD73EDF1E51424FC2959FA5B143CF1AF7DEA2AC8A4E2448A0CAC99526079D95
11642025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exeC:\Users\admin\AppData\Local\Temp\tmp5023.tmptext
MD5:C7675DDA6121F931F9F9D208E122257A
SHA256:B6AB79C23B7FA907A178234309C2277E5B25340DBA277DC661FF68E5948782BC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
24
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.197.134.132:443
https://javadl-esd-secure.oracle.com/update/1.8.0/map-m-1.8.0.xml
unknown
—
—
—
—
—
GET
200
23.197.134.132:443
https://javadl-esd-secure.oracle.com/update/1.8.0/8a1589aa0fe24566b4337beee47c2d29/au-descriptor-1.8.0_451-b10.xml
unknown
xml
6.67 Kb
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5892
2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader.exe
23.197.134.132:443
javadl-esd-secure.oracle.com
Akamai International B.V.
US
whitelisted
5728
jp2launcher.exe
23.197.134.132:443
javadl-esd-secure.oracle.com
Akamai International B.V.
US
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4776
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7540
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.78
whitelisted
javadl-esd-secure.oracle.com
  • 23.197.134.132
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-04-18_8c8badf634f5c15d5aebea34d2233f50_amadey_black-basta_elex_hijackloader_luca-stealer_neshta_remcos_smoke-loader