Analysis
- max time kernel
34s - max time network
111s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 23:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
- Size 37.8MB
- Sample260715-3gl7msbv2v
- SHA256 b665d9eb8aee70d857754009b59bdbb09614dea261453c7bb33f6dffa9de0718
- MD5 acbfd675a4f979fd66240a8157cd570e
- SHA1 678187fc41259156843cd9be00529b6a311f5682
- SHA512 d4ba600ec93388ae352092435bc697aa7a21c88da6207aee4154f0cf6a9940d36352d5b8e27c13b4b1eaed6becf403ab832ba49576820b67119ff9f9b4e6f5c6
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h17:So1ofo1otK
- TLSH T15F978C13F2D541E9D06AC074878AA232EA72BC451B30A7DF0791B7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\windows\SysWOW64\drivers\spo0lve.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\windows\SysWOW64\drivers\spo0lve.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe" 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe" 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 4764 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 4764 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 4764 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 4764 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 4764 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 4764 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 4764 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 4764 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 4764 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 4764 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 4764 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 4764 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 4764 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 4764 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 1564 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 4764 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe 4764 2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1564
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exeC:\Users\Admin\AppData\Local\Temp/2026-07-15_acbfd675a4f979fd66240a8157cd570e_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4764
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 37.8MB
- SHA256 b665d9eb8aee70d857754009b59bdbb09614dea261453c7bb33f6dffa9de0718
- MD5 acbfd675a4f979fd66240a8157cd570e
- SHA1 678187fc41259156843cd9be00529b6a311f5682
- SHA512 d4ba600ec93388ae352092435bc697aa7a21c88da6207aee4154f0cf6a9940d36352d5b8e27c13b4b1eaed6becf403ab832ba49576820b67119ff9f9b4e6f5c6
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h17:So1ofo1otK
- TLSH T15F978C13F2D541E9D06AC074878AA232EA72BC451B30A7DF0791B7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 1.5MB
- SHA256 4ee823198b36be29a075eef608aa2be262cd91ad3e506a0d882d21a130729890
- MD5 ae9a8d5bff6f49bb240848347b8696e0
- SHA1 1da202e2a387b40f5e54f8d6c602a6a654954736
- SHA512 7e50c56f0db64bd590760c57bd6f983aeb84a76d28580dc2777123fbe498e322f4f7907b5db735ba498bf49a75a9d59471f3c863ce34da31d62587df8b515749
- SSDEEP 12288:8ESvdPZD/JGMj4IwHfRlz6YIfrgueRug09fkVJjBq33vb5O8M+l1D0hwsEBoW/lF:tEBDRGo4x5x6YXuquvkVbqPb88hv/l++
- TLSH T151758DA5B5A081B6D0B2C471C4D6B73AEA72BD4217308BC79343CB681E276D1DA37736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 79.7MB
- SHA256 b2b176e6a08d8ae0256448c1a99a7b977c19f630d3d1a728ffa73c24c3d40f65
- MD5 5531468cf6bf69bbccfebc8892ebe373
- SHA1 8b1b08cfa850f0f5870c129f51191fa5d93aec9c
- SHA512 ba1460a6ed079e041342991a8ba7d1c155ac3773e9a524768c62de2aec06a8c489866f2cf766c96539eec1dcc16d71b422591e4f312cb7e428cb5829babd6749
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1/:So1ofo1otK9o1ofo1otKxvyEYKbi
- TLSH T14A088C13F2D541E9D06AC074879AA232EA72BC451B30A7DF0751F7192F77AE09A3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 256KB
- SHA256 a88ab2eab13680012502e10692ec5c6fb70e333b6df630e671ad53aaa93b2f63
- MD5 af7f46b0157ae58d52e704d522cb25b7
- SHA1 3a755ed5dcf12a989f1f5a82dcb425a7e5ab2303
- SHA512 e1e68c322bf33e75a4344996aa0f0d7ba8889c164f0420de2ed2a9ad8c6c887ee64dd6913b70a7bb4495f3ef095738955eedf9900160bdf8071f51791939ba89
- SSDEEP 1536:8ZHGPeg2Sv83fH+5MnNlP/2xbYqrDA0A3MZcWGbJl6JQ3zsHLeKfizF9fxv/UMVA:8Eee83fH0MnNlPubxrrCbJl6yLVKDX
- TLSH T1A84409E185C0A0F2FAD1A17060EC773965B9CED5B7004BCBAB67EF628E6E100531795E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 39.9MB
- SHA256 9cc5a20e564ad18c3213889ab74dcc8d4afc202cf4ebc307238e7064905b6646
- MD5 cf795a7e71ff8f10c9052e766a59bdb8
- SHA1 50b179e6e64dca10ce8a605ed1230a5340adc2de
- SHA512 2aeb0899f363fddccfaf2d3a563c680f056a1c1fc3bac0f6d414c29c55d491ae9c3d530fc037f27f6e0bcfe9d66cd106a1029b511f7ace46b9771b1655179d47
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1p:So1ofo1otKyG
- TLSH T1FA978C17F2D541E9D06AC174878AA232EA72BC451B30A7DF0751B7192F37AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 75.7MB
- SHA256 c93cca42505f6ff4b8a4fee8ca067adcdb021c5ee4ddfbce6dbb27d99578eb70
- MD5 bf778342a7300bfa692a9b5ba29b65ec
- SHA1 2821a66fc1e5702504ad53d4baa858b4c9bdd9f9
- SHA512 714e0560c20330c136e9aace2e4547fb8766f3f49fe28bfbd55bc25877cccecdf785be2834f9940951e03a02a741e400f4bafd1399ba82d065b144831c30a663
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1s:So1ofo1otK9o1ofo1otKt
- TLSH T112088C13F2D541E9D06AC074878AA232EA72BC451B30A7DF0791B7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 71.2MB
- SHA256 f2ecf15b99f5c19f6e15cb1ee683a9759ff85edb59911ed402d3607dff031098
- MD5 9b1ce9337b688bdb8d25a3235aa0eaa4
- SHA1 3b3d5a98210147b62bd9e38bfeb42920a0fee12a
- SHA512 9c933acb1191a6a6f6d2c7b51b82c365ba38223c3d1a3e2d57fa5db994d2c5d7795a0b10986b7af5e5d625171e7079046c004f6b78a3023be7cfda81adb4d7ea
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1N:So1ofo1otK9o1ofoG
- TLSH T174F78C13F2D541E9D06AC074878AA232EA72BC451B30A6DF0791F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 73.4MB
- SHA256 d20fec60aadb5e95e78cc1eed3cfc7244bf07a6b423d717ada8513a37df92bbf
- MD5 8458f538385d983b2b98679a6b0328f8
- SHA1 a0e42cb23efdb68fe057a0a05333977a8bf35543
- SHA512 34e314761bf8a9c8c1e58ab5cbeff27ea1128308e8bead063983d525dd05a98338d70b6035b4808d0ed8becf0164dc188b21f4b31303a7c13abfabe172be462d
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1A:So1ofo1otK9o1ofo1F
- TLSH T188F78C13F2D541E9D06AC074878AA233EA72BC451B30A6DF0791B7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 71.7MB
- SHA256 a4b367a26d59035f5514a1f6f35e66825a6186b6f1d00f36fdae9466a8320a0b
- MD5 b6398a04e9739ba3fea5b2d46084226e
- SHA1 e35374d12dc0f25fdd169d5ea52b31fa3835d3ec
- SHA512 0c1ce236b61fbb6391baebe6030c62b61a2dd53eb45b0d6c00999e60b703281f21dcce33fd974548b4dd65f16ac017240172da0f5ad02e59e0c45e2ec7260ffa
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1P:So1ofo1otK9o1ofoc
- TLSH T1C1F78C13F2D541E9D06AC074878AA232EA72BC451B30A6DF0791F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 70.9MB
- SHA256 0ac4c9ccadb31ed960efbc7d645013f6de6fc57d353b2335014790203396497c
- MD5 64f4770be5a24105b58e9e71b91b1b69
- SHA1 dc4d30792850947fc1fb735ac107554ec3a561e1
- SHA512 25dd7aafbd86738ab12d72d72d86f31d26b6aa54f0e69b08f781a3499402b4dc11b75ee093cf2e755f8815a315cd86ce6a3683f3e0deb19c03114856acc671b6
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h18:So1ofo1otK9o1ofov
- TLSH T157F78C13F2D541E9D06AC074878AA232EA72BC451B30A6DF0791F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 69.1MB
- SHA256 301a59272239b48de861456b66f4309269200b9ab8b025f8c14a2fae47fa35ed
- MD5 2aa70f1a8f0010947df5c3f927d24211
- SHA1 42db03692225a8f8caa12515e9177f8cc1e658c4
- SHA512 3d97d2116b9229f1530369d48118342b182aca612c5a76822e810fa05a35edde3148a0747e9f75ca8e388bd56858271b0bf3137c7477e812a0d45a833cd03ad5
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+:So1ofo1otK9o1ofo9
- TLSH T122F78C13F2D541E9D06AC074878AA232EA72BC451B30A6DF0791F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 68.9MB
- SHA256 ee1c173d9eba2fd21f3f6d91c08321daa06906ba7af0483274628d839922eeb9
- MD5 fd20c0049fd775660bf0f7dce93694c6
- SHA1 9922be96d313f35b9ac6ae46d93b9fc8905014f8
- SHA512 b5aa15da07e526ca0adcea2bc833cc03ea52b48b92ce1788153ed5b97705fbffe6a7bc5a68019b348f09ee343e6ce14a9fcf00c6cd45c67861a8e9722028ff76
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h11:So1ofo1otK9o1ofou
- TLSH T1D0F78C13F2D541E9D06AC074878AA233EA72BC451B30A6DF0791B7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 66.6MB
- SHA256 d45245a332a7fe0783426dc6debd7b092da29042d1f2aad9b2a505be45e69ec5
- MD5 ed27cc105cf1be2efe0c9e1e5965ba81
- SHA1 742520e0549c0191d6521a24e12b871b74a22e72
- SHA512 2a3575dab9fa056bfe9c8340a2baac898bbbb11f44877de39ccce8f39287cd3a04621bd54aac369b8556acbc6176994ea0332a6eb576aedc29a83ae429f6463c
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1S:So1ofo1otK9o1ofox
- TLSH T1E2E78C13F2D541E9D06AC074878AA232EA72BC451B30A6DF0791F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 65.5MB
- SHA256 3e41f6a21f6c14488b3db85566bd64c9a33d880cd8022aa2c19658442a2e2277
- MD5 50f91f26aadf3ac6371a923218c8f604
- SHA1 f5470ebe63f47537b1ca50f65e87718d221a6d61
- SHA512 9ac1fb079af77f14ee396294e08aaad76dad1b59bb2d161be081d1caa4ac9094dd571636325e5fc194e1900c9862074c9e8f4f738ca60547f6a46a546a2a1a98
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1h:So1ofo1otK9o1ofoW
- TLSH T119E78C13F2D541E9D06AC074878AA232EA72BC451B30A6DF0791F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 63.2MB
- SHA256 cba15aafcdb62a5f6e470ab487f18ffb5c1017f50ee50dcaf990ea08ca5179d8
- MD5 1e8f0ae26cc1691b2bc6928a5b028d01
- SHA1 2bf87ba447317490988b3c4af5dac7be5fa427bf
- SHA512 9481652185b5dfc4a0cb2276b88f39b618b258674ee51760aa73988c567d0249362bb8efb3626b33ea788f701876757ba0cd6acc5b91070fd8150a292648ce10
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1p:So1ofo1otK9o1o5
- TLSH T17AE78C13F2D541E9D06AC074878AA232EA72BC451B30A6DF0791F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 58.8MB
- SHA256 1913fb989de21dbae41196721e9d03c6df4cb0d202eddcb42d0ddf4fcee49447
- MD5 a5cf8aa8fa1077d11474421af7c7c25b
- SHA1 5da416c0367a487e7945a21d4024a796fbecc134
- SHA512 0893878dc94a6875c96bb1e960757d106c285f0fa92d1b905c07f2dd78d68b552d0c5e41374be6893895b958717ab67f0f2dab9b1eab44a9fd80855cca5be6b2
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1w:So1ofo1otK9o1og
- TLSH T147D78C13F2D541E9D06AC074878AA232EA72BC451B30A6DF0791F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 56.4MB
- SHA256 104950f5a22c1821732a77042111ab6efd0806760be14a8baeb807f118819edf
- MD5 b8cbb7aa794979cdff3ee2e4b326542a
- SHA1 e9c83945aeeb14c1ec0f12379926bbf753837036
- SHA512 f5208f7116caaa83a74c2716b2d033742d8cab351621d1234241ed33d9c5a5b405e925917e4c3f61d9967955cb472a83d98d66f6d5abf2f38884681061e87aba
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1A:So1ofo1otK9o1oQ
- TLSH T13FD78C13F2D541E9D06AC074878AA232EA72BC451B30A6DF0791F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 55.2MB
- SHA256 7ff2c00a79d53095f261837bada61aa31d6d948b58709c4a8b8d707f43fe5abc
- MD5 96dc2dc9b9986a1a85e1363420f72f36
- SHA1 aa21ec178514db71e6f90209e9227678ba74d097
- SHA512 1a4ba3102ed962d11f9e7ca1a3a9cc7a32cda66c84c7c39efb737cc3ea15570a2c3a98510649c141354951cd63d94b299765ba45adcddac7974739d13ddac306
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1W:So1ofo1otK9o1om
- TLSH T150C78C13F2D541E9D06AC074878AA233EA72BC451B30A6DF0791B7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 52.8MB
- SHA256 28241b687fbc891855a7af285bd231461c18aa0b9e7b6943760e45ecf34bd235
- MD5 84b303e7220063f30b44a8da91b585f2
- SHA1 be311cf487aebb010a7d417715396b0a231bef67
- SHA512 2cd6e19bc398fe391401f5a6a2833dfd4c2ed8fe0b51d83669ea1bb5b1c816eafcb004ac8023459d0bcad921af0af50614d53f103f646e1fb82157755a2736b2
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1R:So1ofo1otK9oY
- TLSH T14AC78C13F2D541E9D06AC074878AA232EA72BC451B30A6DF0791F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 50.8MB
- SHA256 0da56e9cb7da1411924626572127b3e31b3361e2a5139bb000a0fa6acf6eeaa0
- MD5 4ea4512ecb5d2191adf3d02dcc24e120
- SHA1 0d553b1990282a765dff54c6c7b6fbc7beaa2e3d
- SHA512 a9c24926787fb35080c031e6e2a107d51d79c6da6f565c43b1935f0f2b98335432f60db438816813c7e0830187dccbed356afdeb3db899029f72e29331792378
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1f:So1ofo1otK9o
- TLSH T153C78C13F2D541E9D06AC074878AA233EA72BC451B30A6DF0791B7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 48.4MB
- SHA256 4a19a6dd548c98a49fde1d811c791802ee475100e6317829f9cf41fbb546a1a8
- MD5 5831704c330480baea9db24b41ba3479
- SHA1 a3f129df2aa181ddb24fec827f46a2fa4e92bcc3
- SHA512 fd03cc330a9d3d4483f6e83cfd3b7bd04ef3757a0f1520ab2cf7665a75c108ac9752871cc0ea1081cb9ea901070854355b4c8c2a34652c32f8e916b8037a6411
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1p:So1ofo1otK9oM
- TLSH T174B78C13F2D541E9D06AC074878AA232EA72BC461B30A6DF0751F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 47.9MB
- SHA256 af4ecfb2429bb2d89204760310a92607474c5cd51f778ceb7c8be6b6d4ef6842
- MD5 00a8536ce9acc0d33644e16829254634
- SHA1 1936ed6342e24302f9e3dd707ef86ef0f95af076
- SHA512 d06c279fc572ead1dfa80ab48ec2ae9e226d32aeadfb43e7012bdeb8a8a7c5d5b9b1f1ecc3e324b7f0e672d26aa502b2987e09887e7ea43e4913e8de3426b117
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1v:So1ofo1otK9oa
- TLSH T116B78C13F2D541E9D06AC074878AA232EA72BC451B30A6DF0791F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 47.1MB
- SHA256 6077d7cf84d64311e6fa5d63a3d5011df7efd396de249499dc3285a116353ac4
- MD5 7eadf3968bd9f3c8b360dd752c70c3e7
- SHA1 75ec317dfcda6ab3fa6503d8f380293fc0397109
- SHA512 b89f0896a9cf16195e5f3e95934322a3e2b619479e439c5f92807f969f2641a872851068cdc4205c5aad1ae19d0149d5f93a6ee554b30f7f25efa817244eac86
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1m:So1ofo1otK9o7
- TLSH T1E8B78C13F2D541E9D06AC074878AA232EA72BC451B30A6DF0791F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 46.8MB
- SHA256 65e5106a39a448af7c748adba45fef8b4a8e45ef7f6c653bbfa2d1666c61c0be
- MD5 2cb03e43eecd174c495526f68d04d417
- SHA1 cd772a0f9b047d51414430ebd34746291f9ec6f3
- SHA512 07b36e19a72dde1599911cd2fd6f27207d538aaa89f9b688a13508a17bde68f092aed1e78ba85e4cb07b8c4085ae9387c6a73de86390da23fc7cce0f993812a9
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1y:So1ofo1otK9of
- TLSH T1F2B78C13F2D541E9D06AC074878AA233EA72BC451B30A6DF0791B7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 46.4MB
- SHA256 374e8b1ebfdeb5a6e3b1e990dfbf1e5517cd1d0809f1780bd9093a7a5d228bca
- MD5 dcf671bb7d66bd178aa02269dfa06cff
- SHA1 98acff0e79d12b40f94944a4d141e47764ef51be
- SHA512 c5e9e186826a8d18c83e99668eda239e441d00e85c044f0849b3c41990a6f950ced4a0ce9a0c1ecadd45f619477db56f3e994045d247209fcb9da6438b8050c4
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1I:So1ofo1otK9o5
- TLSH T1ACB78C13F2D541E9D06AC074878AA233EA72BC451B30A6DF0791B7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 45.9MB
- SHA256 33af636afd1ca153d5a53578867591081c46417b7877aaf17b5069fdbb3c57e7
- MD5 3f8071f99984e67408ef3c9610a743e9
- SHA1 8bf1d13ffd689f33d061d534ccd338d19ac32e73
- SHA512 a3773bd5feeaf39697fc0191a783563f16ade80c98f102bf16866d71f8d5a4b28a4623a8712440454ea81787832b4d3fb045614ed06ace3c82cbfb3465389730
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1J:So1ofo1otKx
- TLSH T13DB78C13F2D541E9D06AC074878AA232EA72BC451B30A6DF0791F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 45.4MB
- SHA256 7b68c3a73e4f2e297a2839140c19313c688920abb6bd2bada93fa72dad1508b5
- MD5 ffe5c19e9b89b2d9a099232254cd54d1
- SHA1 fab5be29af053d89a4c71b9e51e0721ca60329a3
- SHA512 a55a3fe99e59ead466ab79f1c8252cd97708975a71c8a1ffc9b695db1e8a7d67c285378ffeebc3560e8ae51c6ba88229ea32bcf02d0ec87e75c602767a68b675
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1H:So1ofo1otKP
- TLSH T1D5A78C13F2D541E9D06AC074878AA232EA72BC451B30A6DF0791F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 44.3MB
- SHA256 2be97d7d0cb1c1fffa6841009407fc597b66edd4939484be6d0a97f6959509ed
- MD5 ad67aa9bc9bd190147fd157ab7aa5848
- SHA1 58cfa4e314211c5e4f898c6bb4aefe59d04fdf74
- SHA512 195446aba80c1a7c4ed89b6549f4a791b805d5fff5fed65c7e75b85eff6b0e50d17bc94131edaef7bfddbc914a49babc063393d95e5c69063316a9b475a15831
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1j:So1ofo1otKb
- TLSH T149A78C13F2D541E9D06AC074878AA232EA72BC451B30A6DF0791F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 44.0MB
- SHA256 0e17a21c5ae524a8d19af7b171f46806ecab07936ed1f71f7778278c33aec878
- MD5 7ed6df59625e86222d29f22c3e265cf8
- SHA1 30058edce19c064b8a421d8d901649f1f34ea870
- SHA512 5816c9604d76b4f584f9bdc6fd17b9a7d394c9a03876c1f631c4fc5a26428e0dd9e260b5906f290475efc168ee93b5a3698cf81304c6bcf88619716478302512
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1k:So1ofo1otKc
- TLSH T175A78C13F2D541E9D06AC074878AA232EA72BC461B30A6DF0751F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 42.3MB
- SHA256 91bdf8c0e374f756e41efde2b4fb98c4876d2dd8c1f16fdfd14da81bf49e7801
- MD5 75906cab15080eb16b293f6386332b03
- SHA1 2629114f274264dfe8e3fce0d080ee7455ddb776
- SHA512 f2dce0d0cd01df36b2de08f3f78ef6130446d1b1dd56c77a8ae9715620f426021025d039ac84e6e3726d347b2ce38096ce22b304e99885068f3b728627823529
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h14:So1ofo1otKQ
- TLSH T126A78C13F2D541E9D06AC074878AA232EA72BC451B30A6DF0791F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 40.8MB
- SHA256 a99611310a27cb8e7c605a94cd02c7dc0cdc9c7605bb82cb9d7a0f5481a52532
- MD5 2762a280516f8ff51e66218ab1e34f58
- SHA1 99028fbe3eb08b094d89e49c75102bba19a6cf3a
- SHA512 a2f39827d6566072abacbb7828d67f1adb57e37f91e84fd565c5ad185aa98e637fb57da4b5c7f1adf4163ee643969c242c5be2cd6531f52c335973db5baccd12
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1T:So1ofo1otK7
- TLSH T147978C13F2D541E9D06AC074878AA232EA72BC451B30A6DF0791F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 40.2MB
- SHA256 ce7e8b3394b64d737ebe6efae78fc76e62d755e172222bc18c7688ee52bc8966
- MD5 e59f094b18c1b6e5be660c04e1a58c38
- SHA1 3ebc273a27becea4d665215814ae88627a3f324b
- SHA512 3a94553d990f29fa677edfcd4bdd1a8910a95462c76a8c0681254641091ac5aa5a4d7d6f7d4ad2bb12e62e8eda90e03a808b0abef87c4a909f74eb59e3f7bbc9
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1U:So1ofo1otKs
- TLSH T119978C13F2D541E9D06AC074878AA232EA72BC451B30A6DF0791F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 40.0MB
- SHA256 8a8a606cef9fcc1ba8e0dcda559b66382de7beaeb430d9d37248d96f8787d7bc
- MD5 e71fd30b3ef983d401af8978c16d650f
- SHA1 14a4f77a73d62df347b8d9fdcd7fbfc8aa032c4d
- SHA512 7f13294caddd64af3a84e75ef7cd0e15c20844a1baba64695ece0cdcb61c669949d5fdaa5e226a061947121f0b67e8ae68dda19ef87649e0a6c6ce0f1163cfc8
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1U:So1ofo1otKc
- TLSH T1EE978C13F2D541E9D06AC074878AA232EA72BC461B30A6DF0751F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 192KB
- SHA256 cc71df767f30aa32b4d730d3c0244896e3d45eb216f18568c46371d93640cac9
- MD5 e58d1ddcb93a535eaace748468f77af2
- SHA1 34925438459a8705b0e90d9b5779633b073c175c
- SHA512 5ea24026af3f98184d03eefb9c2fe551e9d91157d2a1a4467729f7e3982c0b73825c729048b92464920fd0c1127ab9b915019274710d1efd3facc314076a1c19
- SSDEEP 1536:8ZHGPeg2Sv83fH+5MnNlP/2xbYqrDA0A3MR:8Eee83fH0MnNlPubxrL
- TLSH T14314A6E189C0A0E6FAD0A57060ECB33965BACEE5B70047CBBA17EF618E6E5005347D5D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 42KB
- SHA256 832717112b24c7215aeb3feecd83917626406645e4d44a9c451ec09f8b1a7b9a
- MD5 dc6dbf3f39eee6f6fd3da3c94029ae1c
- SHA1 4699f536eee874f6275c71b42d7e61640cc5174f
- SHA512 448a6e832c0007d7271122cfebb3890ba96d18a437919f46f2f838ce8de614d5d3b3246eebfa74ed36183a6004a42e615134fe3bad7645eb6167463105acfc9d
- SSDEEP 192:2cBU2BtsR0Mc665DfEoHTgoPQ3bRcLAMZSwSH6BhnPb0SnHnQTt0Ue:2sXDsmJDZzgyQsRDpt
- TLSH T127131DF819C0F18AF8D1D571A4C9B33926EACDE5BB5047DBBC172B429DAE0800397D69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 75.8MB
- SHA256 baeff695ee21e4e8f317b459da0da282600722df9d84772f71261a116cdb89d5
- MD5 e6ab00ef2f5cac318213989779f6e5a5
- SHA1 87862b3efbf24a4c242c7aee8cf42fe4a3f95ecc
- SHA512 36f47a5c28cd8c0ee9c1c13297f9ca9141c80584bc5769ca4205423a5cbeeebac68a584f169400dce50c67ad12505c7d340f77c9ec7cbcc7a8b38a4564908214
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1O:So1ofo1otK9o1ofo1otKz
- TLSH T15E088C13F2D541E9D06AC074878AA232EA72BC451B30A6DF0791F7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
- Size 75.6MB
- SHA256 05d054ee9972404bd53b9541cefd8a702f1cd166c8bb9fa19ca7306fb693ea8a
- MD5 dbf926b79898bcc387c5fd4caba10739
- SHA1 1d27dbf12534d9441504b9610385b98a36da768e
- SHA512 da4b1cc03efe90fd2182cdbd46480afc41c4dd1537ed79423db1ee04321f5db8fc59d024250fe942767bc2fd6127e274472044c687231acff55a720610f008ac
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1U:So1ofo1otK9o1ofo1otKt
- TLSH T187088C13F2D541E9D06AC074878AA232EA72BC451B30A7DF0791B7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
- Size 74.9MB
- SHA256 9e4a6c363f08cae9db84a122424da34c766cba8dbb9590694142ad3b47ffbbe9
- MD5 55e750b6688970f28dd208466a0e9973
- SHA1 3e0c1a206d9e952eb46528dd8344464545d4218d
- SHA512 1bfbbb4bc131c17cbf9b9d713126e6678097b474d92dda2230d506417e65cadefce568e15e090866c935af7ab2281c2c99d588f9a139c29962136f379e258c93
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1l:So1ofo1otK9o1ofo1otKc
- TLSH T149088C13F2D541E9D06AC074878AA233EA72BC451B30A6DF0791B7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
- Size 74.4MB
- SHA256 0d95f7475cc96fdcc68f459805e26172768a8374c3997452bb78df2f7189ba9a
- MD5 8c160d498836aae54114c9a754a9cdfe
- SHA1 1e1c41f909e0a422ef56f5a4ed1224d7cffdfdd6
- SHA512 5a18592135a268c8071f929d5e3fe8ca2d929dc15b50687164d847122a008f9a6025d1babdd7b549cbd2b569b3652266f80a0bdfc29ba3ecefbe2724dc3f80c6
- SSDEEP 196608:Jw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1+TWoKlw/h1+Tlw/h1+TWoKLw/h1+Tlw/h1F:So1ofo1otK9o1ofo1oP
- TLSH T1C5088C13F2D541E9D06AC074878AA233EA72BC451B30A6DF0791B7552F77AE09B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH