0dbc3bd887877fd4a8d501b59d464d867a4ecb7a2ff96f57d84a394ed2538280

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 18:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 1.1MB
Sample260728-xm276avxes
SHA256 0dbc3bd887877fd4a8d501b59d464d867a4ecb7a2ff96f57d84a394ed2538280
MD5 327a48c1c98f55393ab679aae4f26239
SHA1 06110e68e1d2f876000164a7d5a89c7ee28ad61e
SHA512 d14f6292634b4f66410373827148874399c0f25c4a7c8a5fede27b0fdcc58a5ab5a2bd4752f7fd2dd832586833b8d14bd358dd823faa81f138832867c0508074
SSDEEP 24576:kO5xtnlC1InD/MoI9xvkbKlcZOl5MiUOdfgiAiwyx3:k6n7avkWlOvAfgiAiwS3
TLSH
T148359DDBF7608077C82905714FBF9AF30F69682109529B8B13846A9EBE735025927F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2780	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\RCXDD85.tmp	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXB05E.tmp	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXF5F4.tmp	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX9394.tmp	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\RCX7E9B.tmp	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX87C8.tmp	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RCXBF83.tmp	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\RCXE1F7.tmp	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Windows Media Player\wmprph.exe.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\RCXC3F2.tmp	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCXE3EE.tmp	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\RCXBEC5.tmp	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXF966.tmp	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX824A.tmp	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\7-Zip\7zFM.exe.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXBAB7.tmp	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Internet Explorer\iexplore.exe.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXF78E.tmp	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX8FB0.tmp	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXB695.tmp	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.ico	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1860	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
1860	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2780	1860	2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe
Size 1.9MB
SHA256 474ee23f346406cbc4a3942da71d018fcfba71cec69fd6aec58b03a087972c68
MD5 f2f6e2c58efa58af998a77854df6c523
SHA1 f55845bbc53804de19d3ca141099a7924c6c1a28
SHA512 c836b90369791039436121f72007504e92a76c99032185b20c50877b7cf367bdd488f5b689c0d425041b632d7f23a4a920f202a9d7f40e7779d68ac12bc60ddb
SSDEEP 49152:mghYBbiei7rC9S0jEwNFj/X0+d4/xozyVJO:gGvruS0PjXd4/v
TLSH
T19495AD07EF94C1EAD42DC07C864243B5ED667C824B61A5CF4A64BA1D2D77AE42F3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
Size 4.7MB
SHA256 79362584c6355e849dad9664c38ba06c4f7e41143f7197dc6d87751364bfdfbd
MD5 f9cbd41595fdae5cf7844d18132e7fac
SHA1 b89f045c27b6a8d2d9e94469a1b6c7093d6ab51f
SHA512 313cd5bf1657397ee581793cc63a9a55a53a93329e85074a6617235ba09ea8c1fc1ca8e7714ede54f08afa272bbc5e44ddfa51c583828527aa76be5c49f44eb1
SSDEEP 49152:SRJ6WlWlChiFEDtKamBXOudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWP:SRJ6WlWlChiyJKPsijnUdYd+RaAj
TLSH
T16B365903F29940D9D059C174CE1AC226EB627C8947F1A1EF3694B6DA3A73ED43B39760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 ebe43863e6b8ab23dcbe0661864a26b3be0d27e60e09443e2d61bfd5caeca64f
MD5 bab59abd2de054e01bb8ea4630f60703
SHA1 c57bdc3672008d357a2af61790d5edca8e8a99dc
SHA512 2e19ad4e4fc2ea5d77dd2481d41b7282272c31b994bd29fd6b56d0792992115bb70e5df0b1abab8f5c3bae69c840cbf448849e8ada0762e16a05db3daebc87c9
SSDEEP 49152:tYlhYvyDR/gr3KZGu6qG13O7Q7gLYduZrSdHBAVfb:tY7YvyDR/gr6R6YjwA1b
TLSH
T166C5BF43FA9A41E5E059C179CA7E8B74E6717C1D4F2195DF0B80BA193E77AC04B3A3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.2MB
SHA256 0411b7e455b8248d8983cf05c47a224cec1d43b9263fe365cee664dd9fbaa56c
MD5 7416aa0c630eb116495265f6bcee66c9
SHA1 f40c1f5678480a36266f6c74053f7617f9640be0
SHA512 43dbb2e4444710b92598ee1a3adf58be8d0452252908f80181af1db6f4b901194ce4c0d8bc534e985a8e36d72e5badee7c94dd15026b2c7b3bb1161dedfabb1c
SSDEEP 49152:KxF25DW47hsPnY2fF8FhmS86IUJWQn+6h27d6:rWlnbOjjsts
TLSH
T18CB5BE13B2C900E4D06DC576C7964539E6B1BC014B266EEF07E4B6592E37ED8AF3A324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 1.0MB
SHA256 ac5666fc67df238db3a88ad44107ecf5cfc37f5f0475c73571394113386bbbc1
MD5 329c1be98a14337f3b3e60f00b0142dd
SHA1 985a9e030518b2da1d00f4d52475fb5e8e89f231
SHA512 6f49167f16ffaf06c229fd8cd10249fa43dc2ef59547282c56bc3b9fd333aa498060e4d529b3744658d38cd156966d3a5abd9ff39439fcf0153bde9f1b910c5d
SSDEEP 12288:YBn6MVs4gs5I8O9q+PtA5ppDM6NPCP9w5iTJ5xmjM35i6ows0:YNaPs5ojtA53BPC2O1mA35i6c0
TLSH
T1E2259D5D33EBB7A2C028E3B4CAD4DB51D918EC116601892B8B645ACD4C3FE416BB67F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 d0cc70df0177d33328c6f029b6bdab8dbf68716e5a976bb5225637b82f67f075
MD5 1da1bcbc76dc9d6dae264dec1b6cfe59
SHA1 c736035cabaf532d406415f5c819389ef52c7c6f
SHA512 61d0c7741e7f130c2e3d9c40b9d5e840edfbbb1b4a57e649c83b09542e4a48f4cf5f9adfb514a2ed18e50404a2c60e7a2fa8945a07e764411b32e36780100a74
SSDEEP 12288:g6se9/X8yT3xqUdOHJSYiM95EHuiFbvbRJ+C7w5iURw+50k9mnRT0JIxQ4ObTM:d/M6qU8EYiMU3FDbspwDk9mR4qYbTM
TLSH
T15755AF84B2EC89F1D0B948348ACA6761D9317CCD6F21559F06B8A55D2F3E6934BBB330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
Size 4.2MB
SHA256 55404bdeae59b5c3d27fd91cc3712dd1d563242046e3097ebbdd126119984db9
MD5 e11ade6614038befbf9f0064587bfc53
SHA1 510e55c2dc0762797c38cec3d9dad1eb08096c4b
SHA512 cc8323a6b73ea1a3fbe23d5bbc22ebdab351ec72c3d84553d145c75d36bef04468863aa30a140641be19be28a2d83c6e6a98307819cadacdc1cd6c63cbaf6c53
SSDEEP 49152:BIYWdNKS2aBW08mKqRXGPd39PyPvnkSN+EcrxA3vGCDlBYMO74U2y+PhC:BUvbN/ki+EcF0pDeN2y/
TLSH
T14C266A03E19544D9D059C134CF4A9232EB66BC490BF266EF3680B6D52E7BAE03B3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe
Size 1.9MB
SHA256 08f440f68b3034b7798f491b6cf2c9f3d194e3dda700e7a550e9e154428313f9
MD5 29875a1771cea2e02a6658e1c82cc3c8
SHA1 f33e162a2a3e3187d4ee286b7862e7520a06bd22
SHA512 29693f3e8e9343b88b247d8fe776172316c2d6954e6bd485cd43657d0c5d82223068e83b995fb3cb523b4f11714965ff47f28d298f708c9c3c752465bc32c8ca
SSDEEP 49152:2E81BBzgRB1cEGQllp0L5xDzoMY91P27U:P8vIzpQrzoJA7U
TLSH
T1EF959D07B38540D4E029D0B14A6685B6D969FC001F216BEF0A7EB7692E77AE41F7F720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 31e4fb3f8f45b60d4ac6bf246fa3455ee93eb63a9908d74c5bcbf1e125343d58
MD5 311199b01e137d6eade275d8035731fb
SHA1 88d96be0529aa854a6bc745989444914c61474ad
SHA512 ee5523ac57432bb5f60e653ef096fc7789c7caf128979a526aa77b15e97d7499ec6361b63f2fa5242498de0eb28afaf797d99c7e3079df58aed74d02a3800c17
SSDEEP 49152:HEacv5V6cHnIfehjvHHKTdfxINPEt99G2Bo7EukU1a:6P6cHOyjvnORmE
TLSH
T1C9B5AC07B78941E8D02DD174CA269D21E9B2BC994F396ADF1780B71A1E37AD05F3D3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

MpCmdRun.exe.ico

Path C:\Program Files (x86)\Windows Defender\MpCmdRun.exe.ico
Size 3KB
SHA256 02221d573edefa486ba8fe5aee3c8a10c8c7e3188914c0f22df06bb1338db790
MD5 1272e6501512e471bddb879dea4b5800
SHA1 1c8b9489166959e6106095c0974a1825ac1179c6
SHA512 7ef9f685457532d84ba2ed316ec52a44acec151b92e563f6943f593d272745bad0f7c549867a723d2b3532cbcb76ea2b99a965b3b2412d5e7644570740bb4194
TLSH
T1CF6140A1F209FC58C45CD1744DC6C2CC18543D958C0A7273FADCBF8F69724E52E21181
MD5 SHA1 SHA512 TLSH

Submit Download

RCX77B7.tmp

Path C:\Program Files\7-Zip\RCX77B7.tmp
Size 812KB
SHA256 651ff4b93a4475af607b014360ad259d79e06e7bfac880f5031ccb9078d8fe03
MD5 a517f7608a4f320371a6b4534297c3fa
SHA1 e0c53a669be16d8f9ba2f9a26801f1d621d7f71c
SHA512 5917532ae4deaca5fda2c63168ad75a972a90a710c83a62a9ebdad045fd4a19a5181c899b3713f1e8a5f354bb08799a21debe697b03761642913c860f4de6d83
SSDEEP 12288:k9O5xtnlfNw1F0B93bzkZYlTXguVKoIVPQwM84Y5JmZkw5idv9JSZ:kO5xtnlC1InD/MoI9xvkbKl4Z
TLSH
T17F059CDFEB24887BC80901B15FFB9AF70F21681109429B8B174467AE39A750B1997F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 463b6e99198762de39ea3c9156504527673355f452c17063d0fcc34caa3cfded
MD5 01f2c0d2e4df4e0ed544a4e4600d1457
SHA1 2bdf43857fcfeefcd37ee7a82d733ca4e4f1d871
SHA512 8238557d4075faf0d780ce775a6bc0121cf2da9b826cc49095fec9b35096809e5187f3027682db88d7358e21025c5d24d2ef784e9c2b0a8aa7021589ce68a8aa
TLSH
T13061D3A9E5052C3BFD5CDA7935B6DB60C2077ECA021680778809F58328F768B16ED974
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

iexplore.exe.ico

Path C:\Program Files\Internet Explorer\iexplore.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

lyncicon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe
Size 1.6MB
SHA256 21f8eafaeb967ecdf7338a412c176d7b76cfb830564e0d2d7796cdc99dbe3621
MD5 a8a40fc14d7b701e82dd8a2531eac51d
SHA1 131cdfc0b057bd3148025632db25c5be24b80497
SHA512 535463197f48e67d9dc9c7e902a68a13a1595cacc0b6e8cafb49d2d467e2e77261c7a56540a225f611d63ffa000ef62762314a76c7704760343a08eacb347af7
SSDEEP 12288:CO/9Y6vP2NkBuP6t7z7na0OYMBNpu6+BR2FCWCBpdKU3T48Aw5iXMOa3p+:NVP22M6t7zO0OHNpu6IRBp3qZG+
TLSH
T1D7752840A4188469DC1D0F308569FA35F99E5D9FFD0E340F9E8276EA24B7BC068796B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 1.1MB
SHA256 8f13c0c538d5fa3fe983904c32684a5f2d260e9e157fd391f5c1b0cd297abb68
MD5 4e45c61879361f16dee9391fa326cf0f
SHA1 f01be853007bcd5d0a2bc9bb8d1f413271749364
SHA512 759e8e18b3edf6a2e13205bc00b80c095b792844d0fe1125ecfef9d5dd402bdc75845c900293bf178d9b7946a8597c666df689071c1ab52599e17640e615be95
SSDEEP 24576:Nh8dg6ZRNy3KZ6wmBbnbsMMMMQqqiwhDF8oD6DcD6DxDhDhDDVhDDxDDRDRDcDcW:Mdg6ZXe/4MMMMQqqiwhDF8oD6DcD6DxI
TLSH
T18E35CF19A19C58FDCC2505F45C7986A1C7B2BD938B5DB30F0764BE2C2E33B492A39678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineScannerShell.exe.ico

Path C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe.ico
Size 3KB
SHA256 9e3f1f8e5166514df44b02a1e0bf7474708dafba161e263cff087af62ba89ae5
MD5 d8ef82bb84e2efe95de666f46d0c7ac6
SHA1 fcdd2f6ceacde21e1e38a687041138aa5bb0ef68
SHA512 61f7439ba615c3250701aeecb96ab8319f2d84ffa7e61076f6dbfce20ee3409d212e8d9deb274b145b7f0eeed2388681b929ba897bc85b4d3841f7003bc40afd
TLSH
T1C461FEC2D34610E8DA8268F34DB58DC487650CD540E4ED920EE6BCE39A745FDA93188F
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
Size 1.4MB
SHA256 3a07321ef345977605767ad10bc65f89a85a89803b1cbd598efd304ee1551ef2
MD5 c5b3a4d7e7aca6d0f050f600f8c28523
SHA1 10848942bd16088b55adfaafd2d9bd0dac81981c
SHA512 19c02816e0bd5ed361bc24350292f9ecb72d7ff444ac4ec18bf023ea903b8fc3dbf37361d61ea0dddbe1288a5ce800d25555dc294bc83e087cc1a6d6e0418b5d
SSDEEP 24576:eCrLS9RdQjyhA5HFlZKFxGMysZgjS1hqgSC/izGfU2JGlbhlAZ4/:eCyajfKsRjvQo0nGH1
TLSH
T1E065A015E07C80F5F1B5A5B7680C9AF26A7994033A14441EAAF8AB0D3DBC47D13F736A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-7.0.16-win-x64.exe

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe
Size 1.4MB
SHA256 f430f645c0daaa4df5c04896c6a81a2befed8d604bc1c3175dd2a758bf3e7774
MD5 a69f6e68f193652997021e2fe5feb758
SHA1 33a4862b10edb94ae24e9f290f61ad6fc90e5834
SHA512 3c03a673f56470563fa01218f05969bcd5190faa35b2bc35b1792882d20eab9b0f5112e88e964c06a6b59c9909efa54d81046234e7027a0c69a1397a8cb181de
SSDEEP 24576:Wvo0NbdqGx5nlmwOHJcZsXrW2HmAbLZW5mWpI2jFM5sFzfTpi71R8dZd:WvoObdqs5nmppyAbs5BjBbTpi5R8d7
TLSH
T14365BFF67113C032E67404BE9CD892F46D39AE254B2184B6D2E4BD2D3E70691DEB3276
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 27.4MB
SHA256 489ed039f9eefadc8314fb5a7a45cae5ddb646512f3506b68368d04a59de2168
MD5 b8eb9eb6906b01b5dba0b10b004b71ae
SHA1 e31bfc74e247ad61822dd8b461f7a9f31564860d
SHA512 e3fec4c73e3799c0508604973c37bf27721075b71c479ca125bbd3a8550ae42ad6fad4763fc55a57855a64f61e0105bb13aa900a1c7628e7b37d350b183fc79d
SSDEEP 393216:bw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vXL:bWO1c877xqpyovvVWJ6VFK+q3cSvXL
TLSH
T1305722917FE99071F0B30631BA78527E567B7C329B3181DF6282F61C19709C19A7AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-28_327a48c1c98f55393ab679aae4f26239_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
Size 300KB
SHA256 e1e00b1faef051517582c14f713d7fb0a5a04b3d6d2c9ff5f0b9dfd1255a2660
MD5 8bbf2e52589b8c07268bdd773590fbe3
SHA1 a28db3695b89bf0c2f3aca34ee9621f57ae04fc8
SHA512 b09fea40b58ea1669a58f2e4af20c6e8d95fa2b38708a368a4045c1d11f788444316e4cc439245b5de2cdee2b53c211a238f42f8aa5d3df555d2c817aa0a4f97
SSDEEP 6144:5habloKMimZI46P5Bzb854fgJs3uVAOs5qiwckGIk0ggwJhi/rQx+D8:al5MiU50jb854fgfK5qiw8Ik0ggwJhik
TLSH
T14B64AE0276E18072E5721A325D78BA7259FDBD300921CAAF23D45E1DEF31680D63AB77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1860-829-0x0000000000400000-0x00000000004ED000-memory.dmp

Download

memory/1860-0-0x0000000000400000-0x00000000004ED000-memory.dmp

Download

memory/2780-6-0x0000000000F40000-0x0000000000F8C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads