8f2d7ffa886278f00d76007178b25467e50fa9e002ddc15854a6056527195697

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/07/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 1.1MB
Sample260721-saffeaycjd
SHA256 8f2d7ffa886278f00d76007178b25467e50fa9e002ddc15854a6056527195697
MD5 a03bcd88a7351b55bd33ae032d6c7109
SHA1 46b66490bad750283135916abdf53840b961a7f8
SHA512 b7bf6f5c2a237f76beb8eb589f5e7337d012970fb19089be24c06e09a54b88eaeae6c253f0177d6e4ac665ce8af4cbaf40bee41bf2c1ea5acecd5e59cfc82a98
SSDEEP 24576:aOLQTgVL2QtrrwSNPQnxogy4Ul5MiUOdfgiAiwyx3:aOLQTiakTNP7gvvAfgiAiwS3
TLSH
T1EB35BE596D81D4B6D9E506360FB865E2916EBC330CE386671ECC290CDCF35AB1939B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
468	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.ico	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe.ico	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe.ico	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe.ico	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX9498.tmp	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXA834.tmp	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Windows NT\Accessories\wordpad.exe.ico	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe.ico	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXEED0.tmp	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Windows Mail\wabmig.exe.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX93AB.tmp	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXB39B.tmp	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE.ico	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCXE995.tmp	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX8F47.tmp	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX8460.tmp	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe.ico	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\7-Zip\7zFM.exe.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE.ico	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe.ico	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\RCX8B65.tmp	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.ico	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX9566.tmp	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXF918.tmp	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe.ico	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.ico	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.ico	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXAB3B.tmp	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\RCX2E.tmp	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.ico	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.ico	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5012	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
5012	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 468	5012	2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Users\Admin\AppData\Local\Temp\2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 896KB
SHA256 c03dec83a44b1f86851697860dbeb0ca32a1dcabfdb479712170499f993785c3
MD5 4f9a8568e2707aa7056b871f90580a79
SHA1 b8db12dad23cee88fdd1497953ddc1bccb88b32d
SHA512 41d6490c6a5ce79f6c5b19a9cb5588470f3eb55b368adafbd3d3f80c9f0763b3a5abae4c78c2dc2aae06a1ad6c26aa3e42a80803bb3d8182dc75b1c5ad267d12
SSDEEP 12288:JsPNgFbt2c/e3uiP2VlLVaGMmUKw5irVd9Qf85OYmIjE72:aqh2TfP2VltMx3Wo72
TLSH
T1D515AE0A768DD0B9D3AE2830A99552382FB3DF5D0CEE4A17E50CB54DACB464A14ED1FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.5MB
SHA256 1ce6a89e585758bc883ffe3d2cefa7733403feedf924792eb6eef5e15753d2b8
MD5 33d6442f6025b50bd1d93c59eeff1926
SHA1 93b8da256525e6eb8856645f2e7e477df3412167
SHA512 ad5a1330825b7f5e1cfd305d711aee01121353cf9d0e1e1632180b4757eb087062c8d59e538b0fb2c759e1109f627cd88227c333032ceec2fbcada294ef7040a
SSDEEP 196608:Gpqog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb:GpqognqO86IgF+qbM/6HG8QH
TLSH
T156668C23F4E19035E5FB22356C2C673959327BA29F3145CB86907C946FB82D3683936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.3MB
SHA256 64e1d0464e8245e60eb29fb67eb8d50b9452fd82379afc224e36d630b3637810
MD5 51104b79de6a6c8a4dfd59329aec5592
SHA1 8f4c5d3f27a04b4ccf675bae288c811f07bb5f6e
SHA512 f3d88ae3ca0ccdce7b707f93250fd715c8ec7b7a052780469d30d78eebfde72a177b8981ebbb2e8d9344a92df1171edfaf56e1511dc50f49a89ef98bc161e22e
SSDEEP 24576:Vv8db2HQKGiU69+Nfe/TfnLxQOUJtUp90v1XFf3ng7d9+1UXJwhXCTi2Qlkkkkkm:6bXKlh9+NfEBQOitU/03nmdXa5o5QPQ+
TLSH
T17DB5AE23F589C1A5C06DC138CA768735DEB27FA44F6057DF0690BA552EB7AD00B39BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.1MB
SHA256 70143768b45a787af77f5fd4779be164d083cc87f1f20a2ec6c08ecbe0baf946
MD5 a643288266682c4594baacd72f518a2c
SHA1 d3d022d27b2f52fa6fb0b503dd55400acc19a435
SHA512 76f58aa05a4012d49b835e7d4ac670444154e0353931d13516349e6c5718980de36af4feab3af79225335e6fb45384ee032248d5788a2084edf2c7add97fe69c
SSDEEP 24576:2p3T+Zf28BXcKA8EHsV3x6Tk2orgc3y0w9jfGX7yxgCJd1fbgqf1ChKRADe1qRAi:4SUNMAyru0WjiMgCv1jn1ChuADSi
TLSH
T10BA5AF13BE9941D6D06FD474C6554236FA62FD420B2062CF0698B66A2F3BBD86F3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 45546f2c4db7c328cc865ef747ad24fb0c02b9dcf0894b9c02f58457f4670535
MD5 12e7b3972dc58ec01512580ae42a95e0
SHA1 55888fbc4bbbc5580a5f4de05116fe130686452c
SHA512 a7d19eb61db34ea57c5e5bf93cff72d10902b74670ccc72e4e120d2c7b158c52875e90a1497336e18979dcaa1b05a49fd3aff01a1d0c3b107578f1f3e4131f3e
SSDEEP 24576:5N7NYzbih2DZaUErRCsLvw/86n9kAJ9tA3L:53YzGh2wFCsCT9t2
TLSH
T10B55D008B3B5B29AD42EDD34CA0267EBDAB5FC758B21C4DB0A90D24D2D761D08E76370
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 507526c161a5fe0c12dadba5e6d92d9329ff047188aed28c4ed605119df6187e
MD5 97522769bf9b80b672417e3c8dcddba0
SHA1 d81d1e5fc45e432f15d5f3dddc5569cc7233bfb8
SHA512 e5d0ec998e70da2024321c5d4aa36a6d39d78d71f9216bdad2d8b1b4bc1b71b672eadeb9348adf56ee8a9bda6f9482f60d11890fcc4a4bc7ef3b5237d0e4f2ef
SSDEEP 49152:0vFUgf32fehjvHHKTdfxINPEt99G2Bo7EukU1a:AFUm3AyjvnORmE
TLSH
T1DCB59D43B2C80099D02DD474C76AC532D5A37C368B357ADF2790B26A2E37BD85B3A764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 96b81718e7ec8b303bf98de742ad0a8b61bc33d535f8b5f92077b4d9ee9e2ade
MD5 a39299d7953f61605e6564887490313f
SHA1 d9b8b20ba148feac5283ab2438b15af82fbd2655
SHA512 7da6dabd85d840ba6ea921dc4c06350ec580c769660d144fbf0614b4f30b6695f0dcb283c61411794baff8116e7128448a8b5dfc05580fa3e528bc594e9e081b
SSDEEP 49152:w9u/MKTLX9m111srZGu6qG13O7Q7gLYduZrSdHBAVfb:dn95R6YjwA1b
TLSH
T18BC5AE07FA9580B6D05AC174CB768725EB757C158F2096DF1380BA652EB7EC04B3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.2MB
SHA256 a934bf2be73be3673e39956e18ade193967a90265b8efd28b177b92924390d9a
MD5 ffc09c2982bacad46f1a6ca7f7f988a9
SHA1 3478697edf251e88b7085139c8ca8cef519e5132
SHA512 64dd972c91c25019f34c340139bd2f66fca609db746ad37e44d88baf0b0e926f60ca9c1603e161f7b5dd1c8780384c77bba2c3f940095d569e7024e3bdaa033a
SSDEEP 49152:mXhN9MLKkebi1Y2fF8FhmS86IUJWQn+6h27d6:asLKkAi1bOjjsts
TLSH
T169B5BF07B69940D8D05EC7B8CE42813AE6E3FC261B2576DF0790B7492E77AE45B39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
Size 910KB
SHA256 1612d1e42fefa42e3cb35a8d76ab8379a62ed578b19cc4e01d8d65b9d675c601
MD5 2dfad65f2715fa5e92b01a3eab1577b9
SHA1 a79fa2d1bb7c566395481f9c4737cc567dd0208c
SHA512 2dc59c9c6593f070ac9ec72029981c6e09d34c4226b17887404192c0616a2c6502bca953f83e01e75613fba8cec979cca713d8adef72ac3ffc7d56c74f388df0
SSDEEP 12288:RVmA9G+PoduzhJ0YC1L4naGKrw7Gku/TFF9Hw5icqeVZi6xlA/brNPzB+NU:TG+PoWhJEx4ngw7b0TuZXq/bBPzBAU
TLSH
T139159E0577D498FFD998043042F243E95EAFBE257E245003669BB92DA9760988F3E7F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.8MB
SHA256 1f1e4df76ce243daba1783e3d31f08c853eb823cd0576baeff9a53a17dd33e25
MD5 3eea2b63c96c984c6ca837fdbd6ea398
SHA1 615001538363c26080efa2fff79d734b0ce4ee36
SHA512 e70e5d4e37422ded90f9b78cce2dba6a65ae8d8fcaf8336b7c4e1d664da14661867411ef84527b8397d019139745d5f95043630c97f8aaf0010d7c8a83deee7f
SSDEEP 49152:NBjC7AhX5cmj5b/kySYzno7fvTqJdbPrCx9pG7:NBO7AhX+mjpW7fv0dbWG
TLSH
T16895BF1EB29480E4D07DE4348B964635E9B1FC168B24A7DF0690BE8E3E379E45F357A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.2MB
SHA256 7e9b49d4ecafbf9b4d519fa00426b1cafdfdb5ba8d3bf990682d1a7706cfdd95
MD5 414047e469cc301bc60eff4391340bc4
SHA1 2c7a353f94ee4f931ae1303d0553788fe73ebf3d
SHA512 ce446d5c6a9afa6875cff63edf3505b1aa322649037f18079ad94e6bfdab04112e89636cb4e0ae40c8f2b7e7c8620e52c5b98e432db89b68a3ededbfe7eb5614
SSDEEP 49152:I07/x3RA9TwDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:N7rA96I4Ds9Ol
TLSH
T146B58C27B39880E8C06DC178D6528A31E9E17C450F2765EF1B54BAC52E37AD86B3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.2MB
SHA256 94adb4e8693ab9841ddaf9f5c2829194bcf904385c2de060d0b94a3ec83b7329
MD5 0afc8e52981339d6184143bdf167506a
SHA1 ab98a9e35a17f35597528014add6d59a229d4436
SHA512 814acd845d3d5d6f1778d4d91edaaa30fa7210bae3357b9747a8d34210c395898c6a517b14bcbbf1f36d9871eb6197be04fc8a9b499505595789e7c358f0c04e
SSDEEP 49152:7GgtRQubFP9nZEuAuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLn:7QZo/Yhy8OnZy
TLSH
T1CD166A03E2A900D4D099D474CE469223EBA27C8907F5A2EF3690B7D52E77AD47B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.2MB
SHA256 0ec0b7386cbc0f19dc9e9e472573f2379e78d7444a125dece49d2c9c9559a9e1
MD5 d8c932726a2e8f32e22a06da68cb2791
SHA1 7d669c31b6a0f85c9db3c962946e71a0156c1db6
SHA512 c1f32fb12936cae294e5514f27af861225f8a72fda82ec50e8972097eb09e4f776d11e014a972fac0730dfde5589500a8d25dc841bceed8af2c5414504111636
SSDEEP 49152:NSwYZ8qIlYWhY2fF8FhmS86IUJWQn+6h27d6:UOlYKbOjjsts
TLSH
T18CB5AF07B3A940D5D11CC97CC6624675EA62BC850B2C6AEF0750B60B2F7BED46B39B70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

RCX8306.tmp

Path C:\Program Files\7-Zip\RCX8306.tmp
Size 808KB
SHA256 439c20de00a389d0c1e6709713c4148627bc126092b086abd666a86bb0084e86
MD5 478cbc28efdb75c3545b0fa52921a9a8
SHA1 8dbf1ad1bfacb44760fb8de52d3ed5c038a1c399
SHA512 a5f083c47287081f871a5fd07c1d72a97646a43d534ac96c5b78609a1755b452c1284a2fb9faba5ae3ea7ad756a6a1e60d564dc61002ff60191ba558a3115a56
SSDEEP 12288:Je9rqLQTgwDvAbaA25qtQYfrasvwSN9POQU5Ih02SxVXNDogxw5iV:aOLQTgVL2QtrrwSNPQnxogy4
TLSH
T14F05ADAD6C81E896D4D406391FB921E2A16AEC775CD342635CCC3918ECE74FF2929E31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 891KB
SHA256 2e9e1ee3c0ad53f0e5743efd027e88d6c439eb76fce46b1a8e08e1ded5181a6a
MD5 de4fbb5608cb64604dbffa5b489be7d5
SHA1 0c495b6613571c8237ea19ac2c4b65fabf639f52
SHA512 b8fb5b03a3be533f20f95505acb37ed84b6e82b8c0ebe1367171c3ec6768843f0ef783b865ff71ae79c337c76aeca48ab5cbc17c85b4171a28b607c89545d052
SSDEEP 12288:vFd8MfBSRx00IoQjLuuUj4085Fg+C4fGPEJeh8V/FHHbPw5iTVYXniqRlnaF:hBo0/jLRfg+CGGPEc87ncxhwF
TLSH
T133159D58B4EEF922EB851473D9854ABCDC749EC129B346BB48273F5E78301ECD6142B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.4MB
SHA256 5b9971f1fddb212670d4c92eae0caf93e4d33d3c13dd3ee88b0b270e2363d219
MD5 c380f036a0792ba34e6c1aef8121a2c5
SHA1 586ac7c37f83d70cb7030e6c442bd9495a0b6844
SHA512 3349710db8c971b7013ed21d56430c7c1b46854778c16d56ffb5c488bb870e1e2b75d41cea6052901e27b904857aa397f7b3f5c2bbeae110c5abebbc379fa17c
SSDEEP 24576:cdwFVRBjYhCSg7yum39PZfePv3r7fm6t+jqp+3l+zCM0D:Jraa7gZ2HbbZt+jqpQ0CMO
TLSH
T19865BF3DB9516832E7E80DF278949F3C5DB895184E61449FABCCB90D3AB4483B6B7231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 1.4MB
SHA256 b51db85de4a589597e775c0d373141db7f4ca544d185d33e5312f452474a6d0a
MD5 c909a83f98199380382033b32048bed7
SHA1 a3626786fa14c77530ecd6d6c407de70433d165b
SHA512 f42b1ca6bc8d656e46d4742c2a381ed791f644eaa9cbe0559c80342580b2f49aaf897836c9893214a28dc99d7cf8e682c3b78aff9ed0f2a8cd1a2a9340defff5
SSDEEP 24576:hzbjK3rV914Bw//bUjVoWAnPYsMysZgjS1hqgSC/izJfojymk4HM5yJ:hW3x9ec/CVobRjvQotoy4F
TLSH
T19965C0246FD291E2D0FB06326D3862783A7AD1105B11C47EAED09E4D2E674B2FDF7261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.2MB
SHA256 f3829a95c27bb5b072877dabcf808c4957c5670e4b50dd89927092a32d34ecdf
MD5 dd19386a3901448aacab5fe5fa7f1254
SHA1 5250583c32505a6619b290c37cd6c82501464b0e
SHA512 b97e701b1654d39d0e8195cfbca30404583b99b66c1c61b215e1a22dea17a2ae712a1a48d0bc67152212a82adf792db7984252c8d06fad1ef82e558cad4a8e9b
SSDEEP 24576:SpsU8vJtI8JHWxjhvuv8MYenGJiKEbXWtfOkUy:O8vJtIEW1WTPnRWtGkf
TLSH
T14D55CF337694912FD11519719BBFC2A07F2BBC14DA200BAB16A09D0E3F383B566F7265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Size 3.1MB
SHA256 451ff6d22377c6ec29eea180171cd4bcd003653d3e2745569367552199caa9f2
MD5 b34b661b90c8497721be3e2e4c1aab84
SHA1 bcf8a513ef5d5b513e6ececbfa8a6b33a1a745f6
SHA512 464212e0625cf2a168d16872c17a7577c292e8fb12cc76e098ab50d88acaca4c1f567eb9d392277361cda1c6f65466c8096636374b9318761e79cae5f2bbc271
SSDEEP 49152:V58s2QLBRBdt8NVAjXR6t2jgZ8tzPFASjYhMleFLyJwXP9L8vzbtu14BCNbTc7Fz:V58iBUnAjUt2jc8tzhYhMMFW8LMprG2
TLSH
T1A3E5BF22FFD1C836D4B312319AADE7B4557DB8312B31C1DB6788274D1A744C2BA3A663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 66ccdf565948965184b811afaac1f4219e41a639c01741dce6144dcfdf3a6053
MD5 57baf10f480239fbff03925c0798f08d
SHA1 9d02d2e239f4445527e070729a735fcbac3f158c
SHA512 67a5038f259ad67587bc715e49ab30a0ec52e8276bc69a828ca3e15ce8f2d387faf02d63559b63fd66eca21255d19eab2ebedc3a6a972a30b5c25de785ebdbfb
SSDEEP 192:6C0MXSImdNo4ErjlUSFH8SQ2sZkAhXjBS+Wc7HNS/i7cDdX5jE3ev9s1:XC9onlUSFcRZJ5jBSN7qeB5jE3cS1
TLSH
T1C643C496B848DA45D90D5C329FEBD6EC7331BD26CE6B460335C2BB3F9AB30C10A55285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-21_a03bcd88a7351b55bd33ae032d6c7109_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
Size 300KB
SHA256 760c64b2c264d246ece22ad79ccdcf90150c766af0914a24302b02b85dde711d
MD5 945e4e0bc89e9f40a7579ebf46bfed4a
SHA1 a932fb906bfe4c9915dec6b859f0f6229c5db112
SHA512 a1f8d22e778ca7ecedffbe5c4fc08789f9c105a4da8a977038ede2ab3bbfc7c2c55c6cc16f03735153496f4e68516284d324335c1c7533d7754ab808aa1a2c06
SSDEEP 6144:5habloKMimZI46P5Bzb854fgJs3uVAOs5qiwckGIk0ggwJhi/rQx+D8W:al5MiU50jb854fgfK5qiw8Ik0ggwJhik
TLSH
T14D64AE0276E18072E5721A325D78BA7259FDBD300921CAAF23D45E1DEF31680D63AB77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5012-0-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/5012-1002-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads