Analysis
- max time kernel
43s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 05:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
- Size 33.7MB
- Sample260702-ghbxeaav6q
- SHA256 3b50801eebadb11d4f00bc84ac09b722b7d08365c496ddf8ae7fbd1e7913db9f
- MD5 e4f6794f5adc2f5e3ba06e362241f43f
- SHA1 ec71b8f3a7393845cec56d65afd57cf4bc8643c4
- SHA512 f49840c978eec08bfbc909d173706b9cc3d02eacc8321e7aeafab182ce999f6f54b19de50f87d9e5add3748275feefff1a2503654f755e50095f83811e366792
- SSDEEP 393216:IkLDkL5ovkLDkL5o/NkLDkL5ovkLDkL5o/B:IkLDkLevkLDkLeVkLDkLevkLDkLeZ
- TLSH T19D779E03B6E441B9E07FC53496669636EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\drivers\spo0lve.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File created C:\windows\SysWOW64\drivers\spo0lve.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe" 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe" 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File created C:\Program Files\7-Zip\7z.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File created C:\Program Files\7-Zip\7zG.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 1720 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 1720 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 1720 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 1720 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 1720 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 1720 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 1720 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 1720 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 1720 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 1720 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 1720 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 1720 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 1720 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 1720 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 400 sihost.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 4948 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 1720 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 1720 2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4948
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exeC:\Users\Admin\AppData\Local\Temp/2026-07-02_e4f6794f5adc2f5e3ba06e362241f43f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1720
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
PID:400 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:5344
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:768
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:4480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4712
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 34.0MB
- SHA256 9506bbd905f0cd0c01ba9b7bb083451aff0691d46cacfe96ff6b931e37f7c37b
- MD5 e0d8050a6831e1cd82a67ece7f9de783
- SHA1 ae55fb1af9edebd5c534f455f634e86653415601
- SHA512 344ab0121f962bfc6bde32134c56b17cd7e9a6b41db13dfc5420ee0fb2d7536aa6193bc8786bb390a7eade1e2ade398b0196d17a6e7e4d4219c5f8211c3c37e5
- SSDEEP 393216:IkLDkL5ovkLDkL5o/NkLDkL5ovkLDkL5o/1:IkLDkLevkLDkLeVkLDkLevkLDkLet
- TLSH T199779E03B6E441B9E07FC53496669636EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 33.7MB
- SHA256 ea16ff20b58d7741e738cbbe7e880e489ae72c650666b162f8fe56869a339c07
- MD5 716196596ada5e1c942b8b5425704f09
- SHA1 977261a1f5a0a0da7a899d6e2b6d3ccd9f4e67a0
- SHA512 e5a7fd651a400c3ee65794453c9a534df45efe2a12ddcd4448aa0e3c1d9feb7d8ed3ce3f72a74be076f80f056e8ec2b6a61083b20c0b24ff60db29fdddd7a3a4
- SSDEEP 393216:IkLDkL5ovkLDkL5o/NkLDkL5ovkLDkL5o/s:IkLDkLevkLDkLeVkLDkLevkLDkLe0
- TLSH T1AC779E03B6E441B9E07FC53496669636EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 37.8MB
- SHA256 6bbfb14d8dd3a4c547a57a8c16471d7579b29f6321213f66c56fcc1d87b04fdf
- MD5 8c22d0e0cb9dae2552cbd4a978e5c337
- SHA1 ef8d31eae833452fd978a60f28c8d69b552e4dcd
- SHA512 97278b381d5d7bf6f13468b692dd52bf2f748494ee1a6e04d990ba552032d7873de44575308fa3e3e99f012cb74442851cba61122f0f757d6ef10047d4ed6560
- SSDEEP 393216:IkLDkL5ovkLDkL5o/NkLDkL5ovkLDkL5o/EvyEYKbi:IkLDkLevkLDkLeVkLDkLevkLDkLeIA
- TLSH T15B978E02B6E441B9E07BC53496769636EA72BC460B21D7CF4690F61E2E33BD09E35327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 67.7MB
- SHA256 69c4e6cf8f2d8dc5fe8913142baeb27a06d9e84aa6d5ccd11525a0c5d43a4b3b
- MD5 8b1e35cfcd3ae6f66a0db3d9e0c88a69
- SHA1 dff8a92d65acb0fc582b4bbdb99db58661135d85
- SHA512 cdd86924a69c81c7a8b3d4f3bd9e5062c380fab48d2ff19a085ff41196f86e607d7825a3c0af66881ab44c3cf25673c1c4f30c6d564995297fa08ce7e5ae7782
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLevkLDkLeY:v6E6Z6E6Y
- TLSH T1BCF79E03B6E441B9E07FC53496669636EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 35.8MB
- SHA256 51118649ac300e613282d3b2ef1f372070d0ecf2c880ed4c5334ef37f4274142
- MD5 52bfb92b727fb1766989e2b4142a641d
- SHA1 77a85a64275b9a0891383943dac5935bc6e60669
- SHA512 5cb50654cff83d854d8df0bd368abd5d5f652bd01379244d8b7576c962f224e94da44bc8fb8310c21cb124164e4b61ff5711974e30c3346f092e6d9a6267f032
- SSDEEP 393216:IkLDkL5ovkLDkL5o/NkLDkL5ovkLDkL5o/hG:IkLDkLevkLDkLeVkLDkLevkLDkLeo
- TLSH T13C879F03B6E441B9E07FC63496669536EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 67.5MB
- SHA256 e91a0710ae5dc4393bac8937633a48b09eddb9faef69fa840c7a90757440feb1
- MD5 83c8f58ef70b7ec4e9b7bb88bfe9d981
- SHA1 ae77001fa71c9e1a6be4bd70e1df4f72b7f6be1b
- SHA512 14d341539a058f1223ac1a0688d29a7863db763745bfc94817f9d9684c179f5588ffd45cdc90cf012bf27fe25e95781a1dd8e1a138d80c0e2a3681336b726787
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLevkLDkLeO:v6E6Z6E6O
- TLSH T1ABF79E03B6E441B9E07FC53496669636EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 73.4MB
- SHA256 b642a5ea51027a365167c3658767ee3a7da0608949606f950697d9325965e1a3
- MD5 b134dd750e74fed8307fe48350ad015e
- SHA1 1239bdca496a5facfcbffe9026cd3c36ba07a867
- SHA512 cc39841e5b89c77dc03cf5fc4ba5f3af7a75c561182690de4817992217afa01838794c26dbe648085d545be0e9cd411791d1619a28837bee0747d8bee720703e
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLevkLDkLeYFz:v6E6Z6E6Y1
- TLSH T19CF78F03B6E441A9E07FC534D6669632EA72BC460B30D7CF1694F65A2E33BD09A35723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 69.1MB
- SHA256 b98c8443b677fc5eeb55368a4422180eb0847f42ed2958c5ce1fba43ec2514be
- MD5 121fd56c7f74421f56710d56ab7348a6
- SHA1 c556597ee90f032954f2e7e43e19d49352a2b8b9
- SHA512 f253d740509266c7ac3798f341e1330fb8310f1e79121eec664abf2cf28926ca793e06b92cf3aea822bcc752bab49e5c2d0451b8584cafe14cadf0889187e4cc
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLevkLDkLeg/:v6E6Z6E6g/
- TLSH T168F79E03B6E441B9E07FC53496669636EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 70.8MB
- SHA256 58e2615dbbedd2fe9d68c2fbcfbd4eda39a2a2888e703cb1488b4cae9e57a200
- MD5 f901c04bc0c9ff8c0b28fb3ac36c8210
- SHA1 e2d7d99fb4ba68bf8db3d21f4881d648a4876a43
- SHA512 8fb105ba5f0fd2943ede2821cf58f6561c7d8982e4b84f41e338c2677fa17d1841b06a39fe628f7cd175288f8ef99cf5ccf17e73eb694a1fadab7e16c72f4310
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLevkLDkLep6:v6E6Z6E6p6
- TLSH T1F1F79E03B6E441B9E07FC53496669636EA72BC460B21D7CF5690F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 69.6MB
- SHA256 c06c494d3f3c1013b302fd12e6240b0c4ff6dd1f6650f962dbe6829653019d52
- MD5 1a2ce0d8e3b3687f2b8815a5659d87fb
- SHA1 1354bd21a63646b726fc9ee2fe52960cdaeafd0c
- SHA512 ff6d130863fd25421cb9c1e0729147a966ffdba329463676c74f0b1257dc334be1bc76dd46ddc86412d914940a9bbce1b39a400c65edf3c4a9b7803f1a9eb8f9
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLevkLDkLeK0G:v6E6Z6E6K0G
- TLSH T1B9F79E03B6E441B9E07FC53496669636EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 69.0MB
- SHA256 f17cb1504d3576ac764b05b6c10588d95964a583735b8458c1fb2d17833f7cbf
- MD5 a1ebb769ad14c0f6d98e81f54f2d76f6
- SHA1 311e1a96ab11a0a19f947887fbe806b5c92fb20b
- SHA512 8572d08030f2616ade4a96b7275649ddab37b52da04a8992e3f508c5321b1450bff90272a030ebf631ad778baf57aa09db6bf508c4a7ce9b4f4937e7c35b00cc
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLevkLDkLeXf:v6E6Z6E6Xf
- TLSH T1CFF79E03B6E441B9E07FC53496669636EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 69.2MB
- SHA256 8796b72974e593658aa73762de0cf3b2a50afd79b415f45370630ff6d5934f3a
- MD5 ecf29e18fe082a6e86bdb929a85c9dee
- SHA1 b1a0e73734396cb3d0544249f4f862c8d6e59b39
- SHA512 4bbb6dd14aa025aafc9badd1d10f221431a7d15131b60fd1bcfaf2e49a5b69ad982223c541f440368a34b6757974e61eb028ed5a8ee569376fee7c9accabfa43
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLevkLDkLeZCg:v6E6Z6E6ZF
- TLSH T1BBF79E03B6E441B9E07FC53496669636EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 65.5MB
- SHA256 8a103b0bd232970b30ac8e39d0038a4095fe1c28b1a8fd254e4fd5301e5ee741
- MD5 71dc62c22a641d2c12a6ff315fbee3a3
- SHA1 da2cea0514b4495749a06d9f90db12c13014a608
- SHA512 40500d624ce3c0607f7fcd2ed33402dc4c51c94cba48921adf667e8da2c40ef5daa2b12939dd368c8e81e03e7a5480559e30d8f58604cd7cae74cc61d5132bc2
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLevkLDkLeN:v6E6Z6E6N
- TLSH T104E79F03B6E441B9E07F853496669632EA72BC460B21D7CF5794F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 61.6MB
- SHA256 62ab5a5deb02b0c8e2669318da17cb39e4056a8bee31dd703b5a3f014cde8461
- MD5 da970cb8e7a0db6f4972946a8b3ff2c8
- SHA1 cfb4274c79822d9015a5dc0bd6de413f1aa8fe8b
- SHA512 52e002453d3b2da52d822d2ee2428a9d9759f02132ab6808d0b3ffe71dc772e9882e47e90e855772d2ea4e0fb940a2c89b2ef546aa92bfa1a61053f023ad89ee
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLevkLn:v6E6Z6Eo
- TLSH T121E79F03B6E441B9E07F853496669636EA72BC460B20D7CF5794F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 59.1MB
- SHA256 addfec34ae92fd90aa21886067c0f5f577654bb438a047bba5764bc804f5a9ce
- MD5 9c0ee41a163d6841cb9954d283194481
- SHA1 3aac6b719a4369640e8eb2eca67470194e34d3b6
- SHA512 5cc9821c345b6756414cadbf049fefbb5cbf797851f1c7f5674a2ae5dd5f5e9c6fe13f47103efcb104dec57054e1a1ddd676142e242cb46bf0f86d6bc22b66ce
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLee:v6E6Z6Ee
- TLSH T15DD79E03B6E441B9E07F853496669632EA72BC460B21D7CF5794F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 58.4MB
- SHA256 c4c5001d89cd12610e988bfebaf07f43523a57cceb1dca761c753cda9c25090d
- MD5 41ed36ed9102bae74744c3cde5d8480f
- SHA1 ca16ab7f39d55adbbfd8737da8aeda03418f9294
- SHA512 8468adce28f19288ebaa5cf1da21555ff3ff18737e33feb739679bc58285380b1a0a8c91d5942034c7cb05e31afab6423d533ad4a97cc52509dea6cc6a00f668
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLeD:v6E6Z6ED
- TLSH T14AD79E03B6E441B9E07FC53496669636EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 57.8MB
- SHA256 cc5be9d8aa98b18c901f1801cf03cee4e8247d2b367f7faf179c90de3e60972b
- MD5 23b5c7add7a47d30abda89542ca9b7c5
- SHA1 ed49db49a60e7f1bdb748c4dbf681ed547cd3413
- SHA512 f1555dedfe14984cfaa1d98c083f2ec0d4350651385deac009b9d1c837bbb9a472988e4c772fecaa54085692e19f4327f4a2487bcec92231ba63cefa3ac23cfb
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLeX:v6E6Z6EX
- TLSH T1B8D79E03B6E441B9E07FC53496669636EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 57.7MB
- SHA256 c2885c5c295d5f28c374d3262bf21cfc2ca3cdbc583e8223c2971675b3669cd0
- MD5 2d0b4eb9ed51189c4bb82238699975e9
- SHA1 8312eef9064c00c48590549d139e4c8a84822415
- SHA512 f06377e6872e7a11eda74d9ad8a190869de771e3916778ec570e7a06b30b869371352dfc9f9fc8cc449b9242ccc5f094d3c984bb1e08a875c914ce3cb27ae54a
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLeW:v6E6Z6EW
- TLSH T185D79E03B6E441B9E07FC53496669636EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 57.1MB
- SHA256 ac4f017c5a13028eb628db989c517fb96e70352538ebd86c06fb4520cf2a4f5a
- MD5 5705bbf1799fe8214013c2c26243e6b2
- SHA1 c9e71c280c767b47b38c3978ce392ffbed07c6d8
- SHA512 a62a093754e21e550d13575a07be798f0774c71916aecd08a9570e030b9a3fe69b1f714bc2f479b02ef52cd5c46d30dafddcad27ae4b58ecff8a3a46b034fb4e
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLB:v6E6Z6/
- TLSH T14DD79F03B6E441B9E07FC53496669636EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 56.3MB
- SHA256 3f48d317bfc492ccd7cc1ee72ad52dcd670ffd8cac36b1d6cc498eab71864234
- MD5 000f9abcd3de09368280169dea085550
- SHA1 0cff739f0e33cdc005fe41a79ce031b8e52686f9
- SHA512 b0f0ced9f18358f71b09e6db548d3ad6e1442532ce416662497f184104ccd5268c31e4e6dae93badb6c5e375db411334daa4d5e8118700410e4c5054b6ce1dbb
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLE:v6E6Z6S
- TLSH T158D79F03B6E441B9E07F853496669636EA72BC460B20D7CF5794F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 56.4MB
- SHA256 883bb46069d9239db04459045084c6c03507cd27b003bb665e5e7f806555488e
- MD5 eab265b309bdc13a5c7ae791f6a677a2
- SHA1 ebaf2c97ba4616c60a085e5791fc2489973fb438
- SHA512 213e0179a81437079317e9d935428f885fa6e6848075eb9b66e2a45d59a30df1143483b93e895fd8fd6cdca825c3575dc5a4d63c11d8dd9c028ee76ecd81a44c
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLa:v6E6Z6U
- TLSH T1E0D79F03B6E441B9E07F853496669636EA72BC460B20D7CF5794F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 58.6MB
- SHA256 20189f736d3f17fd021032a22d516ffdfde7fa505b0db68407153c9bb0c9a006
- MD5 fe15bc64d32209924561903209ed8f86
- SHA1 1fd38f6b01b814df0f02946ca8f1ff47691d8560
- SHA512 2eb33da0210b72932e65f94cafaaa5b9e73802b708e7e53b2e464088275db38b04bb28a8700cbbb0fd93fc04f88c5b57136cbfa6bd996ab9b1e37b7ec44c4630
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLep:v6E6Z6Ep
- TLSH T1C4D79E03B6E441B9E07F853496669636EA72BC460B20D7CF5794F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 54.7MB
- SHA256 13dcf8e45197106d28c0b4bc2981c66310e0933c15039dfe6707a0b225d7673f
- MD5 a0a8be6835b4ee3f8270781f80c819b6
- SHA1 574f29e832b2346fcaa106a0ac3f2bc77d9cc9ba
- SHA512 ffeb1c2f8ab8bffbf727d0b790c0a5d807a4c320c1a10614b90ce9671fc1b29a1101916ec11e86e22956e2b913b90ad4387d5d2293016129844f4902dd0c179b
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLG:v6E6Z6D
- TLSH T107C79E03B6E441B9E07F853496669636EA72BC460B20D7CF5794F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 55.2MB
- SHA256 d8db1549200a2696eb2c46e7638c76ccedfd9f6853f617c0d87be89816446b30
- MD5 1ffe3944918bc4c1e771a181b36292e5
- SHA1 e0d7bf13bcf3a355f421df3c15bf33346c041f0f
- SHA512 865ea7e2b83d73761d16f0021fbcc3c71cabae35ced5da09cff75de003fb7d73b2c5b719de6963b57708cff1da160a7cfdca00c488f0a091954c0fab27bff534
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLf:v6E6Z6q
- TLSH T15FC79F03B6E441B9E07F853496669636EA72BC460B20D7CF5794F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 54.4MB
- SHA256 f88d36b3d5f04b3b383353dfd33a43a5a1733e252881050934f02a9f8c0c2c1a
- MD5 cf4c9d92e37eea6dbac221c7e2ec9b20
- SHA1 e3d406a2b19e4ac6bc2db3cc94eee5ef13133518
- SHA512 9f06462e35e017e796c86041bb199f3e896852a1887ab97fa9006b132eed7197e3170e1fcdbdaa55535e33416325828231d561adbda42f21a6a6d99d512b61ba
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLH:v6E6Z6G
- TLSH T1B7C79E03B6E441B9E07F853496669636EA72BC460B20D7CF5794F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 54.1MB
- SHA256 e22fe8bdb306001b9414e4737bee1e4e29ccf583908e4fd06aa837f626fdcedb
- MD5 1934ab146e63fa06466edab4e059b954
- SHA1 92495820447ac0bfba37e16c12c391d647911283
- SHA512 c152643c06e8949c60462dce1111813041ebe05fdec70daf4c0ba65ca248f0c0944494bbd3a89896372906e88365cbf992185674f0ccb8ad215aa4c2538a6785
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLr:v6E6Z6u
- TLSH T1CEC79E03B6E441B9E07F853496669636EA72BC460B20D7CF5794F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 53.8MB
- SHA256 e627da8738d71a515f7677603aac53568b1319903361f4140e2150907d0a86eb
- MD5 e63cf426feef954de52e2eb1fe8c9cdf
- SHA1 f83f2004747ed7e83f85f26f60c98e88ce09ac37
- SHA512 c17c304ecfa99ab04967c593de8a36cd2de5422f4e0c22e2177636a9ff44254541405055a7bc109b60d0e3eda3144f3c8ddef001ad6bbc02ad5a099a9d464d50
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLy:v6E6Z6z
- TLSH T1CBC79E03B6E441B9E07FC53496669636EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 53.1MB
- SHA256 16b83e7e46e1c402df4238d26e84ad873e546664d0b6b671b91429e3b476d878
- MD5 6115c891ab3c7bc3ccff18bfbcbe0bee
- SHA1 07f4e5179d14d144e69f526174b2daeb2c90cf8e
- SHA512 0f394a1b0220e3963b5bf897d9c7c321053e98faa361fb793e4954494123281be7952067c758704ffc211217bd2776ea77d86b5909c3929039ce07ab278bf739
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLq:v6E6Z6X
- TLSH T11CC79F03B6E441B9E07FC53496669636EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 51.3MB
- SHA256 2efbb30e1fc41c23e6abc6415d8c04874c1f372b2793cb73fd4d8f6cafe1a1f2
- MD5 6a4d02c3ce6deefeb749e2b28dd4209b
- SHA1 bc2865b12736231777ad0f735a6e8f765de8dc37
- SHA512 5ea39c6450d7fd51fcfd8894202ba5b4a2fcb4631ce48f2a67aa6093d695c1d6288c3a043a10f11727e5d156a93af1d23ca4e9cba3108b936e0ceeeed4beab3e
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeM:v6E6Z6M
- TLSH T162C78E03B6E441B9E07F853496669636EA72BC460B20D7CF5794F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 48.8MB
- SHA256 f7b7d1ebbdbc2cc64b2991c605e91956788089191b63f4744a76eb3714d8af23
- MD5 e096a2feebcc8f58e4daf4ce0c8e5cd7
- SHA1 104b6a83032d81f7fca6620842a1ef4e8506d585
- SHA512 47c2543b38aa3521f199452660263a0022b1159eff4b3b1f5a781c01ec21ac3f5722c69df100f6925a29273adce5c959f89061690fa88a075609fc414ab0cefe
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLe0:v6E6Z60
- TLSH T1C1B79F03B6E441B9E07F863496669532EA72BC460B21D7CF5794F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 48.5MB
- SHA256 26742081d11d89b343de8e246bfb401b2802c247e0acff049e9f3879031a1738
- MD5 ebe680e4a202274fbf676348a3ba97ea
- SHA1 f04fc5931aa5585ca5c85b4f676e030f0286f949
- SHA512 a355a37ff816d74bf705b3551b73fa8db21a996e0608996b1891d6e36e3bc3ea116fe4fc62c3b8b02e640cb0ebaa5d764b5317a6268158a5bc9dcdf1e01494cb
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeH:v6E6Z6H
- TLSH T16CB79F03B6E441B9E07F853496669632EA72BC460B21D7CF5794F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 47.5MB
- SHA256 b9732c5e16b2e827c0cbcc884a1496e2d4db223107d17cba6579f21b8c036ab5
- MD5 861710e5c00cb848a3b685bfa08c25ee
- SHA1 6c9fbe5b085f6b6a5922dad5d2b31f3bf4e0c836
- SHA512 eb5cc2c1c79c52ecb6b02a74e75fb33be7f6274e977b72d50ce1edc320cda874da1f26e8380555d025d8aee51326f5f4072fef4d096dd57fbdf538db9e577324
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLd:v6E6ZZ
- TLSH T1F2B79F03B6E441B9E07F863496669532EA72BC460B21D7CF5794F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 45.4MB
- SHA256 e39dad73f1299546e88802464f8fc794845594edd86374f34438ccc2714efed2
- MD5 99f1796f6dce53b183ad352c471a5908
- SHA1 4726605fc553a4ffe336d25a1600522c68aaea79
- SHA512 da0c8169b0ddbdb18c365f1edf8127049ea7efd9cbc134811831dd4c5c51a35327411bae3bb0c77c51bdca8471a7224b7040bd8fd7e06465a6acd92d87c17a50
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLE:v6E6Zj
- TLSH T140A79F03B6E441B9E07F853496669632EA72BC460B21D7CF5794F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 40.8MB
- SHA256 4f98c3a2d7cc7fe1f13473f1d5df6745362202e877e68626488f7db1f0abe445
- MD5 1206465dcd38244495335bedaaee70b2
- SHA1 5a1e6b6e055ffcc3414cf6bcbb73ab6ce40dbbe6
- SHA512 960bc5006736b4f25e34cffd5b431a2fc159b90de1c0f1f038c86b2e340f62539d488a5a8f3f243041a9380cd09946631e34a38785e91ce850d9a74196bb536c
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLey:v6E6Zy
- TLSH T1F0979E03B6E441B9E07FC53496669632EA72BC460B21D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 40.2MB
- SHA256 8182db39fe42851931687977cff12a62c640737bfa5a9b825a6dd48150033003
- MD5 78525a2e19ef58b8b4de3ce88bcf9d83
- SHA1 015e12a0b1d1c0e94c42b2599f05e90b6285f00c
- SHA512 768164754d92afdd739218eb780f77feeb1f159edde701c70a2be2fa04ab0e01f747cc664eb92e77809a1825a8241ee6c0d2908d2d34b3970897acf68932a177
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLm:v6E6Z
- TLSH T14F979F03B6E441B9E07F853496669632EA72BC460B21D7CF5794F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 67.5MB
- SHA256 677cfc5f94a30b0c078b8d5253c70f11f258d48c3003a507ca8b7053622af23a
- MD5 0ff3b275b918a03bad76f35c210d1de7
- SHA1 8709726521dbf7b2337853846194d263363def52
- SHA512 7b7d723021fa4ec476953c67f753d9b0e0432853d4a740c185ae1929b811a87103cd9b70f9cb5f392d665e992fc910b9c95e0e0285b9e3c21046b317394cc9ed
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLevkLDkLeA:v6E6Z6E6A
- TLSH T1AFF78E03B6E441A9E07FC534D6669636EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
- Size 67.4MB
- SHA256 60cd0a5a76145bbacd723fbf5eb5c2deebb251b9c6e15b91808c74d75f7dec7c
- MD5 e2fe447aba905ad96be54221905505a0
- SHA1 36afc8828d731190a9b2e9a821fb9b729e3f79ab
- SHA512 4d1341dd7bbd8606d227fae122560a57ceea17baa9ec831d6ce0528ae94e6759bb6dd73d17ae65b7e84640b6f8bd29151bbb2cdc0e858b3df6a2ae791eaf8f68
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLevkLDkLeI:v6E6Z6E6I
- TLSH T105F79E03B6E441B9E07FC53496669636EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
- Size 67.4MB
- SHA256 93f56d0b0cb17cc3fdbea0fa15e123a8889a7253626424e6d7d2f38abf89a66d
- MD5 197be18ca9db2669a65ef9d6192de04c
- SHA1 97ab1f745cd777b5129117a14bda85b2c0ef741b
- SHA512 fca994808a379024010ff4f5cfc1aa9a370ad924702dd946d5155497d77843539ad22ede5af4cd213ffca4d1efd9200ab6ed39f5263d3271fa8be136de64f593
- SSDEEP 786432:IkLDkLevkLDkLeVkLDkLevkLDkLeukLDkLevkLDkLeVkLDkLevkLDkLe+:v6E6Z6E6+
- TLSH T118F79E03B6E441B9E07FC53496669636EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
- Size 33.7MB
- SHA256 af27e6ca32ddb5b3c49d94532001b12dfa3212eb2c34305215e94a0300e7ab94
- MD5 5e130f7779ed25a4419771251fc27c47
- SHA1 eae1f6f6403f19871a4b791f1cf035fe34462deb
- SHA512 9b5eeb46ea6a276beb32207c944923a5367bc3aefd6bda799839094b6435251c4919047e6512d69f2abc0ee51d668c5426f1439eb0ffe60e0df3407bb2d0bd0f
- SSDEEP 393216:IkLDkL5ovkLDkL5o/NkLDkL5ovkLDkL5o/GD:IkLDkLevkLDkLeVkLDkLevkLDkLeg
- TLSH T1A6779E03B6E441B9E07FC53496669636EA72BC460B20D7CF5694F61E2E33BD09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH