08b532e7a87d4815c4378a0a85f50fdfc67a7c1ab91b320d01ba8695b33afe4b

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 04:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 1.0MB
Sample260718-esdsmsbs3s
SHA256 08b532e7a87d4815c4378a0a85f50fdfc67a7c1ab91b320d01ba8695b33afe4b
MD5 3d096b3947e875feb523f7d783cfd071
SHA1 11db62cb613773a5e855d2e962847e8190533fd1
SHA512 32c9f5e30869e8266fb1185047d21ccd8800e8908ae9b167ec39cc1c496e19daaabaf65f98771597681470be68817f5c693586509df002525fed62bd56a45742
SSDEEP 24576:a38HINXCFki8487Sd9nWXvY6D8+l5MiUOdfgiAiwyx3:tHwXY/8Sd9nWfMRvAfgiAiwS3
TLSH
T10B35CF0A38A1FC7DD036553850F5DFFC85A5EBE1AC128607276C6A1C8BB1982AF36771
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5048	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\RCXFCDA.tmp	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX2D49.tmp	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\RCX48D6.tmp	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.ico	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe.ico	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe.ico	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Windows Media Player\setup_wm.exe.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.ico	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Windows Defender\DlpUserAgent.exe.ico	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.ico	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\RCX7F42.tmp	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.ico	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Windows Defender\mpextms.exe.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX68D0.tmp	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX375.tmp	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX72B.tmp	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.ico	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX1401.tmp	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.ico	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX3EF9.tmp	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX4503.tmp	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX692E.tmp	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXDE.tmp	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX3D9E.tmp	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.ico	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\RCXF3ED.tmp	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.ico	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX3FB7.tmp	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\RCX4954.tmp	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\RCX4B6E.tmp	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe.ico	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe.ico	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\setup_wm.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.exe	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1440	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
1440	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 5048	1440	2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Users\Admin\AppData\Local\Temp\2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe
Size 1.9MB
SHA256 ec98b59dd6f27ec8d5e3ca0c1aac1113bc16f4ead8cff00b1a3ca650a7a27a52
MD5 95719d8d7733b75ab3790cfa640fa99b
SHA1 6ac42b008e5f572b9d75ee87bdc9623e44161518
SHA512 95d86cb78a9eb03c9e2a94ab4190c303ef294a41572068c6c74550a6abad06377cae854fd5ef7daa6454e624e683a95b6bc884332a798e0b3f2b82c5e5260c9c
SSDEEP 24576:axu6Pp5wP0rXE74t9qryJcPNzprV2IOL+a8G+NMz5/Pem0+dl6ZVP5ozP5IVJXyn:KXEuQvjraL+nNM/X0+d4/xozyVJO
TLSH
T10095BE07B2D6C0E8C1AA8474C61141B5DA617C120F6976EF06A0F71D2E77EE4ABFE364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
Size 4.7MB
SHA256 88c04abc6724fb41fa62ba816b33ed7bc4eba5ec75b5f43c98c140662e015e96
MD5 085ba175552d6fea4e0a450d374a6f60
SHA1 45eab2258ad8b0451c25b4ea54121d53a81e4eea
SHA512 e194f55e3a5a5d0ab4a1686497f7862a10d66e7aaa4c55f9450c10aa3d0c823538cc1150e880519bf43251f5ae287a915e41ff180a9b19342b70493f57fe86ea
SSDEEP 49152:NF/jK7USRFudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:vm79NijnUdYd+RaAj
TLSH
T173366B03B1E940D4D089D0B5CE46D232DB617C894BF261EF36A0B7EA2A73AD47B39754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 e8e71571eabe48f1871822ab7952a278f2ee0aab45b84d0a9dba51db17badf46
MD5 83e878f9abd051cd466a75f5de4528dd
SHA1 6718015f01aaed3c79c8cee97b07bfdb547cc54d
SHA512 2a99c091a650fb1eec19a6ddd2930d1eeafe24be41dc0b31f3eb98ff0dab0352872ff6cb6ac28611a4e9048379450124d64158890170e514aa57c9a932314d93
SSDEEP 49152:8K3NK7IYitd6jZGu6qG13O7Q7gLYduZrSdHBAVfb:8K3NK8Yitd6lR6YjwA1b
TLSH
T1FBC5AE03FA8581F5D069C2BA8B668BB5D675BC559F2055DF03807A292E7BED00B3F390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.1MB
SHA256 096357a1797200aad44f1340760e9a9c1dce3ece8fdf027ca5d4a218250ffc6d
MD5 09a0a4d7b6bfedfdc8ab47a168800c68
SHA1 0bd0a4d95f992f576421aac77050ae6337ec2aef
SHA512 f3d23212d8233c4549ab500f15fcd13f5f45b2c2be73a7b48575cbb3e6dd557f067591739718eaf3426f68a60fc49cd9991513a2c15469ac140ea7c2c1a3421e
SSDEEP 49152:eZ3GjSdrxjY2fF8FhmS86IUJWQn+6h27d6:e5GjKbOjjsts
TLSH
T19EA59D03B2F940E8E06DD474EA564726DAA2BC190B2473DF0BC1B6192E77ED45FB9720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 988KB
SHA256 54c28e7fe8164eecb220dbe881e4bc8f0691e91b34a491fb7be0978e72e3e3ee
MD5 e7e5461958495b29ced8729708ebdd2d
SHA1 6c5acd2b5b96e113ee576e24aaaa92635e679581
SHA512 35d6af56e4611fc1b808973f46b840d231cce74a9bd1003c602d8a5c0751945ca364e0bf7972dbd70638465b4d5527fcaa9382f2df820b6497b49af34c4b7698
SSDEEP 24576:Skc4N+Q6iQZIurE30+bXI8em2TUW//6g/bm/q1pDA35i6c0:7D2TUW6g/UdpX
TLSH
T12225AF2D75C9B051D169707489CA8FE9722DD8721D10CF97A2DAD64ABF233707B22E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 5d4f4a42539bd02deff335f79b0ff5c6e3508741af55a2c6ad6f1a2d6596860b
MD5 21a227a5beac59a47f632a690d795a27
SHA1 75e7c58a509203893c8380da71935d97dab4b003
SHA512 3d68bc7e3279c022a1a5c2baac17d57f17f3f041f23537e916925562b53e58f8e5cbf0b4a52ac5a45fef9ad215ef709a6f69431e802990573072ff06bf754a89
SSDEEP 24576:0kH89RMfzbmyeLA8j62iMYE7mz/9JFOHjqz5VPtb2FhabnTFh6Z84hi+qpYkxCe4:0NV2xCml5vmWD
TLSH
T10655CF04F19445D9F9BB9430898B8583CD62BC830F719F6F13A9726A1E7B5AC6E36730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
Size 4.2MB
SHA256 775b15a789966f091a18689413444ca5a59efe520c7a1a4fef0ba58bd67f8bda
MD5 fd29a214e1a26feea8a7f9df456ccb1a
SHA1 9e36d3b56ea92c2bd4de84dc960a075e386723f3
SHA512 2348266fb13ae61edf7da875649587a4b6fc7ed5e06aa228da4aa76c57e24bb17a44a6fa66f484d794931d3da2f98138104942c6930fb4826d589413a0beb6a6
SSDEEP 49152:3g4Aslz03ES2aBW08mKqRXGPd39PyPvnkSN+EcrxA3vGCDlBYMO74U2y+PhC:3gfDbN/ki+EcF0pDeN2y/
TLSH
T162165A03A19500D8E059C174DE869632EB727C894BF26AEF365076E53E77AD03B3DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe
Size 1.9MB
SHA256 877721f5424f91fcd3b227d13cc74f547751ac51dbf7f3d8286a0ffe327b2ee7
MD5 d35cf8f0794919c4f74204f6717ed805
SHA1 b5f86ee054efd506c4647fd24019ebde6b1df995
SHA512 054ba95a2be788be338755308a32492f186088b304747689b7d9ebd99b347f7f5589825e695998365ee23b034a12dc8db0c14f128c74b91e395a51c501d11bd2
SSDEEP 24576:E9FjVOymukJfODgsrL1cVlyYlr7QPiKlWk0eTy5xDz7EqnPATW41PcL3LU:IOukEDgsmqYN23lp0L5xDzoMY91P27U
TLSH
T15195AD0FB29784EAC0B9897585174633EA727C120B2167DF0294B3192F77BE43BB9761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 2e2d559853343d942ca3fdc590a5bf02fe4f789c76795f05774219081aaa8cd1
MD5 35d89dbb7004fa47569542958503c50d
SHA1 ca16d44ac16545f5fc9049930e2aa9dcccb40978
SHA512 32a98947d3fe3473a770f50664f3c46523e56934e90c19258b55fe69d10329e7fadf27f2497b29417dd009b36d40b14429e31b0c12050cb31125654ffa751cba
SSDEEP 49152:/RVhSSJfehjvHHKTdfxINPEt99G2Bo7EukU1a:ZvyjvnORmE
TLSH
T19CB59E83B29940D9E05DC67BC6469132EAB27C514B2876EF1F9077592E3BBD48F39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

MpCmdRun.exe.ico

Path C:\Program Files (x86)\Windows Defender\MpCmdRun.exe.ico
Size 3KB
SHA256 02221d573edefa486ba8fe5aee3c8a10c8c7e3188914c0f22df06bb1338db790
MD5 1272e6501512e471bddb879dea4b5800
SHA1 1c8b9489166959e6106095c0974a1825ac1179c6
SHA512 7ef9f685457532d84ba2ed316ec52a44acec151b92e563f6943f593d272745bad0f7c549867a723d2b3532cbcb76ea2b99a965b3b2412d5e7644570740bb4194
TLSH
T1CF6140A1F209FC58C45CD1744DC6C2CC18543D958C0A7273FADCBF8F69724E52E21181
MD5 SHA1 SHA512 TLSH

Submit Download

RCXEBA3.tmp

Path C:\Program Files\7-Zip\RCXEBA3.tmp
Size 768KB
SHA256 47484f537ec3176fbab779d6318b62574447f3b08ba611a7422270b2b785c83c
MD5 ccb38044f4f7ebb2fefb17e0a8163792
SHA1 7527c5e940a7d3bcb314fc6d430d05156c46b5e4
SHA512 dc423644a8b3536d397c6b8bd4ae70342a892a94dcba4309c679b1b7f0998c8ef513714cf77afed34f400ee366388a05cad22bcb9c67770e0a9ce30f71b3c314
SSDEEP 12288:OHb3z4Hi5QNhaX5wvFkin8cj87SH99nvOXXOMY3QDq39w5i08:a38HINXCFki8487Sd9nWXvY6D8
TLSH
T128F4BF0E28A2FD7DC02A9538A0E6CFFC8591DBD1AC068503673D7A1C07F68956FA6770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 463b6e99198762de39ea3c9156504527673355f452c17063d0fcc34caa3cfded
MD5 01f2c0d2e4df4e0ed544a4e4600d1457
SHA1 2bdf43857fcfeefcd37ee7a82d733ca4e4f1d871
SHA512 8238557d4075faf0d780ce775a6bc0121cf2da9b826cc49095fec9b35096809e5187f3027682db88d7358e21025c5d24d2ef784e9c2b0a8aa7021589ce68a8aa
TLSH
T13061D3A9E5052C3BFD5CDA7935B6DB60C2077ECA021680778809F58328F768B16ED974
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

iexplore.exe.ico

Path C:\Program Files\Internet Explorer\iexplore.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

lyncicon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe
Size 1.6MB
SHA256 91f1796d43b128d72a09833673cb34228089bfcec427891362aae1fc03349f04
MD5 56dd171237c0a8901336b934176412dc
SHA1 9ad4a37708b37828c60ca29403cf3e6bf9dc9c78
SHA512 7ce0adfcced07eefc2dd7754c15a8ad655f29817b5903ff4950918d5165e852274dd7986f4ba65cd1fc1764a0251df66be773fb75a0de0a173ef950d64c8613e
SSDEEP 24576:aL9GVRZkaJMtupQEGJWJU2w7X9Y8Sn2+D+:hZLmv2INYs
TLSH
T17F753911B408404EDE4C6EF0466266B0F9125CAFBF6E304A3F94766E29B76C36C2657F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 1.0MB
SHA256 5919b8e63b0910e87d6bc48cdba51b3356d860f4750db494d5108374407955f5
MD5 a3ba0e6c6e4fb4e0d7db53651dd7d9ca
SHA1 c7d09c47171946f77dd17e7f895848b8fdb1c4a5
SHA512 e67aa637f1a700af09fa6eb4aace7d9e1591a9bc53e0109bdd0ec5a79d2fff9cb7ed058ed9408db35d6a40452396f1a15e9a098a5e42461f2afbbcb9db40ffda
SSDEEP 24576:yzpa9In15wiFqzk01QGG+87FVKyzLoxWXYfDtczAe:yzIGn183n89zLCVtcv
TLSH
T13935AE19F770DCBFD93B753668E6A2A982B23C16F6154D8B3E905B0C1E332645931A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineScannerShell.exe.ico

Path C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe.ico
Size 3KB
SHA256 9e3f1f8e5166514df44b02a1e0bf7474708dafba161e263cff087af62ba89ae5
MD5 d8ef82bb84e2efe95de666f46d0c7ac6
SHA1 fcdd2f6ceacde21e1e38a687041138aa5bb0ef68
SHA512 61f7439ba615c3250701aeecb96ab8319f2d84ffa7e61076f6dbfce20ee3409d212e8d9deb274b145b7f0eeed2388681b929ba897bc85b4d3841f7003bc40afd
TLSH
T1C461FEC2D34610E8DA8268F34DB58DC487650CD540E4ED920EE6BCE39A745FDA93188F
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
Size 1.4MB
SHA256 1142694721c4a8abc61ae0d4b0d201238044bb28664e06c139723fefbcde5f7e
MD5 e1507d011f0aee68e17517ecd5f15e36
SHA1 561a381adff7a131732cae4698faf352571c46e7
SHA512 d4bf5759a051a5c4dc632a2e120e0afcffca1a8838e57517dbcb11f7487a851a30d18e807ed96e2355671d0625e577f55b7ec70570b60c60a2ec8e5d3d45cad8
SSDEEP 24576:1jTWbWHFwrdDdP3Y1hb1ZbpYMysZgjS1hqgSC/izGfU2JGlbhlAZ4/:kbywZDdghbnpYRjvQo0nGH1
TLSH
T13665D036EE548C72E2BC4433A839D2F27E2C9518DB42C55B56D6ED1D3EA008117B72FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-7.0.16-win-x64.exe

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe
Size 1.3MB
SHA256 8ae8e0d7d399b239dda61df14e4b91aea9619333e90df7da55da10b3137a970d
MD5 86991e63aabaefeb1a9e10f7944d2318
SHA1 a4ad7ff95bdf3f5099d56e77690482a99205ec60
SHA512 ce3b2b8346f5efed37587676693cab62e40bef89cd89738ea5fa25cba3da54228e9a899611ac55ad619d24289f20f8f4ad430fe555c9d7d2cd586c5587ec65a3
SSDEEP 24576:XYi8cZpMDoRH8VCpyfyKNsVrAIH5mWpI2jFM5sFzfTpi71R8dZd:o3DycwWFIH5BjBbTpi5R8d7
TLSH
T1DF65BEB1B3504033E6BD45779D6897302E69E66CABC08B3BD6D4A90D3C3648226BF375
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 27.4MB
SHA256 c21c71378dea09c08b800b83e1d0b88963b11b6aadfa23847dcd93a08aa4a67e
MD5 1c68fcb8a7d46708761d9e57b069397d
SHA1 ea9eeb267edb8c2d6f42a7db3acd38412de27f83
SHA512 78e4c36cb0c619c84abc0642a7d165355f099c85ace11c891a4ad460c1a2f8554e4847b115f6a15ede468257ba8ae36f475df67822c66c8b61c19c40e9fe17f6
SSDEEP 393216:qJw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vXL:qJWO1c877xqpyovvVWJ6VFK+q3cSvXL
TLSH
T150571292BFE8D071F1A70631BA78167D567B7C615B3181CF2282F21C1A709D1DA7AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-17_3d096b3947e875feb523f7d783cfd071_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
Size 300KB
SHA256 81c85c5c1ece17544bf7715ffec571df48a8bae6fd139d8360707c42acaf398b
MD5 363c6670f8b4d40c332b2b86442aada8
SHA1 3af35f8475d690719397e8bff60aeafa2945fb8f
SHA512 671505285921b8a3b396b69904beca8de644e92b4af26c5c02d07d7b74e7a4fb51bf1b9362eb0c9e71c9b3f62e07a48a10e4179fd7991ad7b1e4142d7424936f
SSDEEP 6144:5habloKMimZI46P5Bzb854fgJs3uVAOs5qiwckGIk0ggwJhi/rQx+D8:al5MiU50jb854fgfK5qiw8Ik0ggwJhik
TLSH
T15D64AE0276E18072E5721A325978BA7259FDBD300921CAAF23D45E1DEF31780D63AB77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1440-0-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

memory/1440-785-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads