5678b2fd64ce562fe9704f83ba748f0a361bec9c9143a7c6595af72246e25951

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 1.1MB
Sample260720-brscvsbt7j
SHA256 5678b2fd64ce562fe9704f83ba748f0a361bec9c9143a7c6595af72246e25951
MD5 6795a1698bc0baa865676bbc410d70a0
SHA1 a009089f7459be7a871d4122e2dbb5f0324dc90e
SHA512 2bd6e733a83420eeae8f7463c069f0ea543473064b053e8575905ad518c6a1b94c9381b603724097dab3970b8944fa4dc46735b65ecc0e57d59a47eb31dcb24f
SSDEEP 12288:16IYXBL7nHovMB1dmqsEtm8quYEnuQw5iQwl5MiU50jb854fgfK5qiw8Ik0ggwJH:16IYga1dwhufuNDwl5MiUOdfgiAiwyx3
TLSH
T19135BD4634A49B3AE028087F4DE56BD9AB6EEC20383181175F94B91D7FF3741C0AEA75
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3488	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\wmpshare.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX3748.tmp	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe.ico	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX6B22.tmp	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\RCX75EF.tmp	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe.ico	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe.ico	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX6A15.tmp	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe.ico	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX86A6.tmp	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\RCX8FB3.tmp	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe.ico	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX38E5.tmp	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX2FFD.tmp	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX431F.tmp	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX26AE.tmp	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe.ico	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX4930.tmp	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Internet Explorer\ielowutil.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\RCXADF4.tmp	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.ico	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\RCX9364.tmp	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe.ico	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX94EF.tmp	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX2974.tmp	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
984	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
984	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 3488	984	2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:984
- C:\Users\Admin\AppData\Local\Temp\2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 876KB
SHA256 24f3877026406321c8a0d778828c0376aaa4bbe2b9835198db5364ff6472a024
MD5 9ab4d8759a45cf46dd6b5526c66aa6ef
SHA1 0a3231a2811872bd30bebddb801baa176482f61e
SHA512 6163e4f50890b7de588cb1067c6cdf95eadf623ec89255bc98cb661c3945f5e5045ea566cc6bc7dabe6e55894c70061bab21b5f5dd91481fdc5d43ae48a45dce
SSDEEP 12288:PTuT/YaHbFzZMquI7478Xk40gVp7kZh/ae8mcNitL2w5iQOJjYmIjE72:LsV7mJqp7e/38i5pOP72
TLSH
T14F159F1A326294AFDA1E4F30755E85B16EE27E2B461203277331362EDA76A3C443377D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.4MB
SHA256 5c96af1942c086cd7166a3868f1ce68b718b3df70bf8fc0bdcecb924ba379dd3
MD5 600094f2010f307c5901dd99a73611ca
SHA1 5d8141754ff52a69491936dcc35dc0f6394dc21d
SHA512 74285dc6c5551736e4dfba85073bac97fb9d9783b94d740aa410f7614c9df22f5b39b5341ad9d76b78784752a7f32c4b3c07e8d15ecc2dfd341ff8bcc87eb5bd
SSDEEP 196608:8HPJsog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb:IeognqO86IgF+qbM/6HG8QH
TLSH
T149668C23B4E08035E5F732796C2D573959327FA29F3185CB8694AC846FB42D3683936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.2MB
SHA256 d4b6d4b80b75a0d873c67a665a3d28e5840a338bf3b632ec1e5ab6105fde000c
MD5 b79d71bfc52010157159bb6ae413e4d5
SHA1 e5efebfe85d6a94fc435d45c2897ec1f10971e0c
SHA512 cf34a67164ad63901641f6f33db82d422baf00bf9f4acec47b20fb60973de3ae5c9cbdac3cf0ba42de7333b4df14193ea1a1d5d60f3ba7955c831a3c6dcca27a
SSDEEP 24576:LlNSoEs86+lZ5TJhOFBLxQOUJtUp90v1XFf3ng7d9+1UXJwhXCTi2Qlkkkkkkkl8:3CZLMpQOitU/03nmdXa5o5QPQ+
TLSH
T13DB59D47F69590E6D09CC238CA364770AA727C624F6155EF0290BF993EB3AD45F393A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.1MB
SHA256 d153b48f5fa585d4ca6d47f9cd9c6f2f2691742dcc896315de4867c2bbedad3c
MD5 12069fa2060d4c0993d4f84a94a51d60
SHA1 dfa99b928349557b21bcf33357676106eb5930f3
SHA512 fbda400fb36f450414b0d2ac84fba8a744eb0c906966b1346cedc813dc5dc9c948d7bd2b7e1bc2b7e9197026c624004eea43845d474210d65f8cb03ab22a9c6a
SSDEEP 24576:F2XWMpYucaiAbsgGrx/a8IqForgc3y0w9jfGX7yxgCJd1fbgqf1ChKRADe1qRAi:UGvuFdItcru0WjiMgCv1jn1ChuADSi
TLSH
T19CA5BE03B29991E5F01CC0F9CA5E81B5EA667C464B34B2DF0698B6092E37BE51F3D760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 5bd7b095372b7669d31526e98b9dae1909eb65706746e827cab464100efeb744
MD5 f8919ba511f77f8bd7b29f287e824656
SHA1 ee5971b765b0e34bc0df95d211d8e8d218f883d7
SHA512 5e12fe877bf344f60e058cb1e4caf2c7a2c40208b326c31a974e1947a80d3bda1730fd29a695eb7aa7330fd56f3c8331f7006ea51d98566672e70660a54b2dea
SSDEEP 24576:jWzejXPllFiYaQYVwE3tm7e4pd86n9kAJ9tA3L:k6N7K8T9t2
TLSH
T17A55AF87B6C582AAE27AC1348D478AB4F672BC857B7195CF1261932D1E731C41E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 967aa535e6e21d74cbdf12b811b018fc27a6a0f993fa9b3b11cc6f3c2fcab0cd
MD5 a0dd9bd60ca85f2464e6199f8c29c3a0
SHA1 d5e050c8af154fe2f47993a6231bb844c46402a2
SHA512 edf1ef6008594e6db68e4c85528231e3db105d30f9632edbceaec33832eba88792fb232a5018b3797859f427714e99522182c04d9f1ba5d1f92825f9b6104d9b
SSDEEP 49152:fFiLHHV+EfehjvHHKTdfxINPEt99G2Bo7EukU1a:dQHHxyjvnORmE
TLSH
T13AB5BE03B29940D4E018F0B4D6568531EEB17C4A4B25A9FF4A80BA1D2EF7BD45FBE361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 ad42b7afabae87542b488a67afaad11f4af414fe3357cd13c7b2d6603b24f6e8
MD5 15579582ebaaa5e9f3e4e6662d622a3e
SHA1 4c1a448cd28ac24e9f53dd689d50beae32b5f434
SHA512 258624e1ca0f1837630be1241ff38ca84ba72840acf70862d9f537a9ebf46b0ee7e606e3f728c8402cb6a92a4337fbc6363f6a1c3c212bd842d49588f97cd550
SSDEEP 49152:DsVTgtq1/ZGu6qG13O7Q7gLYduZrSdHBAVfb:cOqrR6YjwA1b
TLSH
T1A0C59D0BFA8540E5E099D6788A368735D6717CAD4F2197DF0280BA252EF7ED44B393E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.2MB
SHA256 814b1fc98e81c4f68b4187a5b78096883990ea4c6a8d3e69a305da8ae49ab81e
MD5 9cbb029de464b5a32507509422ea5c30
SHA1 2180cf4fe008359d09ca4ad2b117385ee0ffee03
SHA512 cd0aab7fc321a8fa604db492bae9606bedf401e75c24ecb30beb64497aae0f9c792b342dd1c3d6c108cf062903afdf527a5fb2c215e65524b82ae70df2f093de
SSDEEP 49152:rRvLEjRH3Y2fF8FhmS86IUJWQn+6h27d6:rRzK3bOjjsts
TLSH
T1FAA5ADC3B69900E5C0B9CB74CA42C939D9A2BC434B2CA6DF075477491E7FAD85B3A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
Size 890KB
SHA256 49f9620961832e71486fd38c63cdbe57687494971d36c9d61b5782df4edecf75
MD5 593dd8da29eeb880b89f25adcf83b2a3
SHA1 8ed4aa4ba861e18e4c80d07e55f1cb99834224a2
SHA512 5311b13da8dce6a745eeee260e35737f1e3ba165ef939df80fd030335fc38bb6924b8121ddadd2524b1f053936b549e98c9e2dbe2020a35b01d0541076ec6ae8
SSDEEP 24576:aImAH9Xc6jknA8nU05eucNa4WTbBPzBAU:NH9Xc6jkzU0IuRBPVAU
TLSH
T144159D55F1B08022D02D99328D97D6A46F6BAA3FAA27460F170D7BBF9E20441DF1633D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.8MB
SHA256 dc2452a949a7be1db3db3169ea39b8005c2b442f72832f4c368a7e9d62777095
MD5 b2136a3fbefc493f4784aad79aba1403
SHA1 82e3858bc6d5d09438c684e69b081bb34649fa8f
SHA512 baa996719fb6bc8908c5047baafcafd88b1ce5aef1d60f503cc11d070a2ea988678543a09ddcc4cc843bdcab021f1c4ab4d51a293ffdc11ebe205c9b2ba91077
SSDEEP 49152:JkRo9eUCcLJdbzpiYzno7fvTqJdbPrCx9pG7:io9xFdnpG7fv0dbWG
TLSH
T1C3959E0BB984C0D8D028E47989564771EA62FD920B3096EF0695F2891E77FD4DF3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.2MB
SHA256 683d6bc447ecac16dab4fffdb8ef32ffcab800ef23d06c875036b1c7d6fb03a1
MD5 a35139bf13f9b1dfb44e49c9987e45d9
SHA1 449d7248870d71a7cb06f4a58b09eb7675de504b
SHA512 ed645da59126ee73b9b5f8a6be9d0f58c18707aac9746d8eed27b72c502c7a47ee2d89624bc133bba673d4e9a7af2a4a89c219b0c776100656cc0bc7b6496428
SSDEEP 49152:Z9rEqnqPNJRv4DvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:DgqKWI4Ds9Ol
TLSH
T104B59E07B78A52D4D0B9C1B4C74AC536E5A27CA14B25A6FF0748720A2E37BD45BBF360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.2MB
SHA256 d79478e0e816ad6154d53041e60936907461ef8bf7fc161d91be7be72e8cc39d
MD5 fb5b01b51b48372af1709248460c06bf
SHA1 631254d23a424c370e715f11d07c44ebbe66d2a4
SHA512 6001d1b3ee0873bb581a76990b02db72747b5ee412cf77af3a77df2e5e0e71d92249699d0d2ea9618c1ae3cf9e4fa3144ca94eebdb4e8baba899f84bbcaf204e
SSDEEP 49152:79Zt0kwuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrZ:d0o/Yhy8OnZy
TLSH
T17F165A03B19A00D4D069C074DE4A8222FBA2BC8D47F165EB3690BAD53A77ED47B7D760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.2MB
SHA256 15fccf2f1487dc90617f997b4eb419cbc111d53ed286eff2479d28ab9a9c34fe
MD5 acd2fe810f2afb0fbbbc6469e199c46f
SHA1 6739039104428cecdf2cf7ab2bf8f37d50d18584
SHA512 104a13094fb8721a157c18c6b67ccec680bad25be6108d2643cb798da26c2d7b4b1ef13518bf963fdf26663f78c297af7700a7fb876cbb390525f5636150a3d7
SSDEEP 49152:cMfROIxsza6Y2fF8FhmS86IUJWQn+6h27d6:BpfWbOjjsts
TLSH
T1F3A5AD07F28940D4C059C0B4EA029935F6657DA6EB6861DF0790770A2FBBAE45F3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

RCX2640.tmp

Path C:\Program Files\7-Zip\RCX2640.tmp
Size 788KB
SHA256 e8dfc44ce7b704e0bcec3ff53342f0bead9790cd01cb40257c4e2ff86fdd59f0
MD5 e3fdf27bb7e313b42d8010112df2cc8a
SHA1 91876ee9d90923ad8c7e192f05cf6390b70aaab8
SHA512 d515091e2024ba77d104663f2a80e55f606656d70f91fd5efa20f6bf971f5fb2c8781c64dd110e80c456d2571a4a1c4857f2d8e627cf4eaef07d9cb0983904ec
SSDEEP 12288:16IYXBL7nHovMB1dmqsEtm8quYEnuQw5iq:16IYga1dwhufuNR
TLSH
T177059D4A2498AF7ED02C08BE4ED627C9E76ACC21797540129F54B91D3FF3745C0AEA78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 871KB
SHA256 fbaa92ac492ef29f05a4057d087302c210668f45931ba935a2b84098cdcf28d4
MD5 10b0dc073e9e688dafe16cbb0db30935
SHA1 69e59fb388fa749f59879c4bbcda3d2bca94dfe2
SHA512 4d3ebcac380d76e26772c56ac939b5eb18d6d81a98ad9279c8994b139b27554e41042db41f7830fc3b14236037c514186cfe5c2dee5d762d1e1082106671f6ad
SSDEEP 12288:51aVGA6TSZ9GYWsWFImjyw1OvD0tvLkA5xsKLyZxjWdkhw5i3BH2oNUF:x4XG5hF9m3AsKLyZx8oB3NUF
TLSH
T1F3159D81BB829D65CEE90EF2BD5865A01A67FE034E1605AF02357B4FECF2940B541E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.4MB
SHA256 b90700bb30bc18278b139aac29be11118bd814bd92eb90da4d8cecbd31b21977
MD5 1a00b3f8a83b6ecad1bb94a3b8294115
SHA1 dfe3d51510b890c4870fa4cfe79eb25f9f25b506
SHA512 365246a4a8ac800d351d1e2d1b5ff3dd58e9c8285be940caccb934dac0e9a40eed8aed6afda0834cccb37cf383b2f7aaa60a0a278c286e7b3d797f850239d49f
SSDEEP 24576:AD0FF31G61NXrqMMMMMMMoqQYMpm39PZfePv3r7fm6t+jqp+3l+zCM0D:ADM1Nn36gZ2HbbZt+jqpQ0CMO
TLSH
T13A65AF21E4F68031D2F5CEF299748A706A39B9240B8845EFDAC37D1C3D747559BB3229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 1.4MB
SHA256 195c620a73e3cf207c387e681ec9823fc7bf4b0d0cfc2fa73c853f26707cdb88
MD5 9845c0d211bdf60f2e9ca2b8c8e6772f
SHA1 3865cea352b166f191ae9a7de4576c325645d410
SHA512 05e4af457de1982d42b4ce6e2e63c78b570a89eb607f6384cf155f8beedbf819924dfbc44047f9996529ba17ca8d816d4e0ca63d5ac66858e547956ef5206201
SSDEEP 24576:nwuFsDXvWsee1eVGeLDJx069fz/APMysZgjS1hqgSC/izJfojymk4HM5yJ:wPO1U6hmRjvQotoy4F
TLSH
T16565BE26E991C022E1F30873A99991706E6CB8193B454A3FE2CDED1E6DB40951BF73F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.2MB
SHA256 71adaf7b0dd4d022dd4f34c3ccc81f5b29eed03f1927dfcf97ca476c0a2b5c46
MD5 ee296fc2138b5f1682e2e2cbc7eac826
SHA1 19afb4cd8bbaf22e5ae758126c0ffbc7d0f5d607
SHA512 7e15dac3cafa89c37a9da7d841d7080a4dbe92cbf6452f1d879d4154ca97015351b33766b20ae8159a8930248ae3ff08db8f52e1f215d3a3262701d6b6800488
SSDEEP 24576:kgrxXPJZ3t88ITaaxHRu4MtMYenGJiKEbXWtfOkUy:nrxXv98zaatPnRWtGkf
TLSH
T12B45AF36B1FE843BC1690073871AC1B02DE998D54F10841B5657BF6FB97C2E29AB7632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Size 3.1MB
SHA256 5d3d74ffa3d96955c5226943b03b445e285b5e9ad3ee688398b89a8935c880f3
MD5 7e900563c4f478853f9406e9cfcb1df8
SHA1 9dfc581936e930c5edbad14a8e36243eec580666
SHA512 cfe74a26a8a6bac00cbd111984299dd92181049d691353a4dc214186bf6c5a75c0056dc6e5b190f4b079b69c6a6fd79e89283baf8e6ce470c6e805680579be7f
SSDEEP 49152:8wxyxiMXKlaJ+t8NVAjXR6t2jgZ8tzPFASjYhMleFLyJwXP9L8vzbtu14BCNbTct:8YMSo1nAjUt2jc8tzhYhMMFW8LMprG2
TLSH
T116E5BE22B785C03BD16351319ABD67B8A539F9326B2181CB63C4675F1A704C37B3AA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 89f700050d675266228b3cca63ea490d71728a55a648b84c273af66d3d096f06
MD5 5738d184590b924a34a1392e8fb0c2e3
SHA1 7b2f60272a086279bf524d309c8afa59c06efbf1
SHA512 6cf13efcd7e29e972758d6134e7b654602a494b07e8db78549fa8bcbf4314e6ad516ec973b2922315ba32cb3b5deeb3931ee8b39025218c959357ba43ba7f5a7
SSDEEP 192:yeFE/s+/HBXheTvFvySXPU36KmhS/SAUS3X0SGpjKF+WYgQ8Z2:XFE/pdhwdqysoS/PX0S4BWYgb2
TLSH
T1AF43D652B844CA45DE095D365FEBD6EC7331BD26CEAB421339C1BB3F96B70C50A19284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-19_6795a1698bc0baa865676bbc410d70a0_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
Size 300KB
SHA256 ac09dc0262977fe5299580be6089b5e7a366a4ee650198942e00bfd06a026e7a
MD5 62edd3e49207a4c49ed3acff497a2d73
SHA1 e5d6a36aa78a686dd7ac6e1f4a9f771ba75b95f0
SHA512 eca93e947186a3e3e8b19f3931f897b02c8adfc8b797c4352df5108981f4d33f31844d69bb9fb7fc46d1f74e2c5da9d531439d186a0d6c1c58c0ad90006242ff
SSDEEP 6144:5habloKMimZI46P5Bzb854fgJs3uVAOs5qiwckGIk0ggwJhi/rQx+D8:al5MiU50jb854fgfK5qiw8Ik0ggwJhik
TLSH
T1AD64AE0276E18072E5721A325978BA7259FDBD300921CAAF23D45E1DEF31781D63AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/984-0-0x0000000000400000-0x00000000004E7000-memory.dmp

Download

memory/984-1130-0x0000000000400000-0x00000000004E7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads