b4123822d5066fb90aaa468a61ec29fcfd64dfebf98a5abd26abcf6fe410f507

Analysis

max time kernel
149s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 1.1MB
Sample260804-dedp2ser3s
SHA256 b4123822d5066fb90aaa468a61ec29fcfd64dfebf98a5abd26abcf6fe410f507
MD5 5664548653709b453afef52c2afb5f71
SHA1 c1ae69d1ef2bbebc3d80e085c676c50db0be38da
SHA512 c78c9367afd63f5a086cdd5855b55b59f3ae7b2f54e90af5c0933bc1d744bb9d7a59ae75679914328fdf48ef6e224cb13416ce2037b65b4c3ff416f61e20b2ea
SSDEEP 24576:xzX99qZ04aZrodC4sdtgyl5MiUOdfgiAiwyx3:NX3FFgdvAfgiAiwS3
TLSH
T18E35AE02B7419463C82C1571786C99A6297E7CB62B054A1BFBCBA69C7B33301F427FB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
688	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\RCX6AEE.tmp	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX8B36.tmp	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\RCX49D1.tmp	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX5470.tmp	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Windows Media Player\wmplayer.exe.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCXA3E5.tmp	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX5DCD.tmp	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX6A6F.tmp	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\RCX939D.tmp	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.ico	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX5C8F.tmp	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.exe	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\RCX92A0.tmp	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3980	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
3980	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 688	3980	2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Users\Admin\AppData\Local\Temp\2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 892KB
SHA256 2f50ae42e2ce970334b1fdfd008420632a39db371e9caf51eadd510fa9875e18
MD5 fcdcf119878a4df46e8b1ad515ab2250
SHA1 dc769024f89f9a45675a99cd4f81e16560a5283d
SHA512 8a1a487b966eb8c0ba7d203e50ee322933d55efa294007fe28544fc752756a751ddc5a3b8f5e1af26bc74b23f9ce5a35d5c1809151a0be767b93e4dea8fc8885
SSDEEP 24576:/xXlhUg3jdURJTrcFm71aTYpHWt6y2NeTlh172:/KLaApOlh172
TLSH
T1F215BD5F30E3A07BF568113A01D1EAEA775568707AFA51071A53A7AC1FA0540AFBCE33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.5MB
SHA256 7c91f946740e7e97b323102f6dd71bafc0d340c22d98d21e930fca305f4e0353
MD5 9e21bce6b42f6ce018b8113bc677aa24
SHA1 5b5f18ce6c4fa8bc40560f756beddc8b74fdcbc3
SHA512 fdc86151f65a05d16e418b31de51bb3196bc2050a8821ad86baf6cb3b8fdca9fd11a5e8666b1f6d151516ad17f47711d2951c141db471d4a8e002983af1a2915
SSDEEP 98304:LZyog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7ws:LAog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb
TLSH
T13E668C23B4D09021E5F732756C3C973959327BA39F3546CB8794AC846FB42D229393AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.3MB
SHA256 bfa54f7c2d1ac3e8174a7b7b619f62549390c8ec374ad4b3736abbbe7ba39ffd
MD5 e3c94fa39cb3e5debf702579f51a3df0
SHA1 21eca6713d923333bed6ee5560aafa54873247d4
SHA512 b1e851aafa7e08da822049249f7495c22f2e07459e5509c9a344da6bc2c8aebb101dd34aed75b13ad328a6cd3ff37367a343a7783457550a69e094ddf1b2eaed
SSDEEP 24576:eSEY4OxNv1TsS1CqfjlWgE3wNKkrLxQOUJtUp90v1XFf3ng7d9+1UXJwhXCTi2QV:eDdMXtJK6QOitU/03nmdXa5o5QPQ+
TLSH
T10FB5BF37F28592A5D01DC778CA2A4F3CE7717C624F1C56DB42A17B262E72AD04A393E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.1MB
SHA256 2ae3290c4fea0955b629d920fc2c3357ad445f5417aae83e1cb45375db920e86
MD5 bcce341904d4e60f52572eac319c8044
SHA1 b5167aba61335d9827ed89db947f429cd1cc4476
SHA512 712df10d71ba01cf12f0752bd0c2d93f02960eec14b7b1d8065465c7cc4e56a992885bf87a87118f91468fb4c2da833d867271a6d8c1c38758280dd5ec094984
SSDEEP 49152:1To8wsFrsEibby34hSjROLzD54p2lFjbru0WjiMgCv1jn1ChuADSi:1k8wsFrsEibby34hSyR4p8jXWjN1jo
TLSH
T107A59E07BABF81E8D06CE174E65B5235FB717C814B21A5CF0258B2492E37AE46B39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 3bcb45d3d55b51fe4b91af1fdb4234d0e16b7cb3900e6c55583e9ece56487328
MD5 e236d98ac018c204acca0b4432b6fb02
SHA1 dccc029926b9213eedda72b214ee493daae41b3c
SHA512 6fbd37317ba7ed4ee0443f71303454fb6b76a415ef1726d09c3b5f566613e7f96463f67b509c24f22145ee2e125daf6c7a5f301fcf6c1b462358c6db0bbae680
SSDEEP 12288:Yod02I16vuEhHQ4wKrENL5IwOBDMotNfCQqPw5i6sbkhtvES86nHrUA9HVlK8SQ2:zdFGEhw4wbydM8NfR3v186n9kAJ9tA3L
TLSH
T1D655B007BFE549D7D02E823489028F95F67238853BB1659F0F8492792E6A6C45AF7F30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 7e964a8a3d088d51409f9e64ed356fdbcf33c12c385a8e9a613ee5656468e174
MD5 8477a936d76fccd753d37311fb8c4c08
SHA1 444f5280c8d5d01e92f01ba2bea8fb4d9cdca627
SHA512 beecd985606719a3cf8965829b21206b08b09e17b7009f3e0fbe2edbdc4da24d94caf4fa1056f8aa296b3dbc9cbf2f1419897c18a29b6d13c4225275f63c0723
SSDEEP 49152:UETDKaWFx9TY10r2LyfehjvHHKTdfxINPEt99G2Bo7EukU1a:U7FITgyjvnORmE
TLSH
T164B59D17BB9990F8D82AE175C64A8D21DEA27C410B35A6DF0750770A1F3BBF45B3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 b5edd851b75356c90ea15ac0aaf4d4bce7b91543cb99bdaa60da1a449e7f906c
MD5 a6fa855378fd82ad35b8c8c1c583309a
SHA1 9d68d1e94c3a42fef6cc39175897c2360d4a216f
SHA512 b92d29472182741da9de5c267f5f138a715f203e8b89247773f942690ff99db3d9aaa96c83c733085818dee8b7f77c5c8ca3a1a66fcf879666dc60f3d53b078f
SSDEEP 49152:p5bdNc0fq0iQyxiZGu6qG13O7Q7gLYduZrSdHBAVfb:HZ2xxyR6YjwA1b
TLSH
T19DC5BE07F68B80E5D06DC178CEB68725DA727C585F2165EF0284BA192F77AD40B3D3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.2MB
SHA256 ccc922fc47353a7cd1212397d4243b97999529df63e8077ed24eeed52c2bdf12
MD5 f43db8c12a644bc9336a487415365dde
SHA1 05d830814b0fca81e85a729f269231a45624ee7f
SHA512 861db2bd03fabd6e0d1764e5b23f4974147fb6b98305b1e150c1e1cdbd970dcd4c46d1dad61b6309e30764933c6573aec1eaffb10ba5978f82a28d5744b5c62b
SSDEEP 49152:PwDIshmNaXXXX9rY2fF8FhmS86IUJWQn+6h27d6:2ImlbOjjsts
TLSH
T1EFB59D03B38941E4D059C27CC6978E36DAB2BD054B24B6DF1F60BA592E37AD44B7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
Size 906KB
SHA256 e3d66fd4e8310ad1de807d9e8dae67acf6ceafb24a0ddc413a7491bea2ed3286
MD5 98fc5d19dda2c2efb5d1cefac575e3dd
SHA1 31cec91e460eddb24e42f4f43256f9356c00de44
SHA512 f85762d62976c56f7df8df0951436650714cb342cc1246539c536a1367e54d7f620b26389f427520521ccec3f1b76a12ffb9e51f1bdb8a640771215ce8720b77
SSDEEP 12288:Vvjv28S+k/fzCgi9JgHPjworMFIgHBNewRsXRS5a5w5i8USbrNPzB+NU:J/nkTdNv0orMtwwRsBYaanbBPzBAU
TLSH
T18815BE1EB4BAC42BC47D0973068EB5B45D256C07C907BD4F17C0AEBA6B219876A33E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.8MB
SHA256 621418ffb90e7a85204239b3eefcf30acc7b65361cf1693e45a2db20b0d0918c
MD5 042602e91ca4c7f30361ac8042044339
SHA1 d6c8fb906c585d4ba1a19b186e7a74e943f03477
SHA512 505ee3707c19c281b27939efe1457d6ef650408cc0a3ff1586142b97b565c3c1bc006063375a198be403eddf3b265f67981911c36ab4fb6fbbb6395c21f2b743
SSDEEP 49152:6cQneehFfxm4KDewF8XFjYzno7fvTqJdbPrCx9pG7:6bG8XF97fv0dbWG
TLSH
T11A95BF06B68740EBD02DC47CCAA28231D962BC130B7C67DF0695B64D3E76AE06F79761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.2MB
SHA256 8f148df42092774e31c4eeffac7321b03a3354d4cd40a01a89e461ddd8582b20
MD5 8dc4d7dbadfd4f2d8e56566eafed3479
SHA1 eab41aebbf27c7d29debd8bc079456edc4f87caa
SHA512 cd64efa6e098261ccdfe1e95239728121cdbfec106964d24b98845656bd0278f22ebb9aa87371ef69eccbd17ad5db963350b7395ad45ce84ffbe9030328f2c8f
SSDEEP 49152:Tpfm84/o+WfeDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:Tpuo+ZI4Ds9Ol
TLSH
T119B59D13B29840E9C05DC474C6668A35DEA2BC410B24E6EF0B5DB6192E7BFD4DF3A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.2MB
SHA256 80a83ea8b34e5ea3642be542732395fc50b6861e9af89baee86ddc9348036b05
MD5 ba98dcd9cb7fd82d43cf0bc2ffa5f401
SHA1 43e1bcef658d96dd0a1287adc4dae67d8960f5cf
SHA512 7af8c6c78e937a977fd00605be0a67add960752569b8e715265d1881dd19c191c7cedd298c8fca0022de0f1a749a712869e39f66f2befdae3c8a1faf4fc01c1a
SSDEEP 49152:HHEDIgN3nOSBcRAAASk2uZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaT:HHeN3wAAASk+o/Yhy8OnZy
TLSH
T10F166B03F29900E8D099D074DF4A9222EBA27C8D47F166EF3650B6E52A77AD47B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.2MB
SHA256 50513157b9baeaa826deb476fe92e0b0f08b88fc24bd6831115fc19ef6940578
MD5 ae5eef01be085f21c3fb478c7d7002d0
SHA1 229bd9f9e9b1a7e4fb0bae208ddc7c3556f94a6b
SHA512 8cd12905b971a8ecbda6523234c4a3deda18d8bf9824c1343bdfbc7208ce0b156425dcb1c294f4133c2017fb01913289d6993152ccf2c386ec3c3539f8685bbf
SSDEEP 49152:fWX5fnMOqCYY2fF8FhmS86IUJWQn+6h27d6:y5UOqCYbOjjsts
TLSH
T1EAB59D0BBA8940E9D01AE1F6C65AC436DDA2BC050B65A2EF0750B75D1E77AD41B3FF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

RCX43AB.tmp

Path C:\Program Files\7-Zip\RCX43AB.tmp
Size 804KB
SHA256 c6d6ea632bf9f3e1893811a49aa918af967ee3d2f598afc6dfa3b471869f96bf
MD5 b3657341e166251b359830234e02062c
SHA1 70af91ca45bc331a576c8b5b4e787d1aacf5378d
SHA512 86f3f88e4f9bbcbcb8d357ddcacf224115f6585cc975fe6c8c948fab919ba88696cb95027e4bf4b0ff275a8e3d3eb45bbc91cd7cb38887eb5249afd1d4a26c70
SSDEEP 12288:f1NXl0uX99qWzMqdkxLjEpl498cDYj3odTpY3w5i7dtuY1:xzX99qZ04aZrodC4sdtD
TLSH
T197058C47B7429853C82C55B1786C95A6397E2CBA3B054617FB8BA69C3B63301F817FB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 887KB
SHA256 f2eac2b56190ada65bd96b5ce626b7a0c388e19d9c63da7a9708b6d4cd874958
MD5 8a4c354a54424044577110d9dd1005de
SHA1 8639367f5907a98e4f15e9676728d68f489cddb8
SHA512 ad89671029c54fa487389d7fe985c42ca62ee792a58f76eb1e1d938166c4ed83ed751c9e570a65734e86f50af3ac9fcae9c7d1a3c8ef2d62b432c7303e7187c7
SSDEEP 12288:WJILP3T5vJckCfetlsj2Mzp9jKs6tKre3Vow5ibsRCUQ52C0FcF:+ID9JckAetlsjVLLmfmccF
TLSH
T14B15BE456AAD8462FF5E08378D4A86F0F972DDD12C1AA8FB46B87B6F1D761C07824331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.4MB
SHA256 3a36c9f0d9db09a6d09a8c2d1aa6df25b2c816469801c8dd56ea61a60c5d516a
MD5 7a0c4334f648a5ccb11769da1b303060
SHA1 50661e28fa6b480e9fc68a841a38ea3df9969cdb
SHA512 848c060025be5897d4c822170236f5f39af6d12e2b8fcbcc8bb0ed24164fd13ce5762548223f285825c352e4b8b8e0a42db549c6bee6d3f6b44a5bfda64f6166
SSDEEP 24576:jJu0rRyBpaf+TX7H2uQKjZK0AM7FBLc0hyv5om39PZfePv3r7fm6t+jqp+3l+zC3:0A+TXxZVAePnhgqgZ2HbbZt+jqpQ0CMO
TLSH
T1BE65CF317D23F472D36805F2982D9F742E26967D0A36442BA2C19D5D2BB54C21BFB2F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 1.4MB
SHA256 bda073a1d712c405e23e243c536df973e98f133b71eca313fe9d84f8d54e4968
MD5 79fbf492e36bda8368719bd3dfd6090c
SHA1 66de876cfb6ae94e1a719222f77be155d120af46
SHA512 a6f9124c342db128d0348a7edcc69e965121325033b6d1fda880ae0d95907bb3b07f59e8b356f0a3737a4f69d45a9e39d1d4ae941a990849bab356352bb95d13
SSDEEP 24576:TeF3mEveEx0dShvdGbMysZgjS1hqgSC/izJfojymk4HM5yJ:TGLvNqQCbRjvQotoy4F
TLSH
T15F65C03564A1C012D2F509F3DD8BF6F46FB8DC541B408A7E92E4A9CD2BB41E522B7272
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.2MB
SHA256 5b7c6d57a3496675c579cfadccb276433a6224b69161624e856777f05eceb3bf
MD5 48e64fa0feafd62d6fd4432c00302c87
SHA1 24b4912295e76a7772e8ca8784cd59bd02373de4
SHA512 6cb212767e93fdebdd3c8a40c76fe1871146e758f4bfb95043b8462d97a70164505a09e5396d89e2e7c8e75ce259f58ce67e2d342f549c226821b5fcf8ff2f6c
SSDEEP 24576:p2E/fEjGCsPoRRvzxpmur89MeMYenGJiKEbXWtfOkUy:VuGCnRvzPdrJPnRWtGkf
TLSH
T1B955BF2AF1C78812E06D18F99D8192602E387DD9AF10455B275479EEFE38511FFB232E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Size 3.1MB
SHA256 503dd7b22012be0f94bf1ff61e421744f01a0a64e7fba4454721fb357f183a73
MD5 3881d6ffa5d4e65297f6eeb9c0a6c0bb
SHA1 c84824161bcb1cfa691d04d41c3d360281f146ee
SHA512 7b289e08b6e510ffa4cdf72c970d8a8b9002910fc1c9ce2159a43359b495b150aedc588be78831e5f204c5c5ddc8760cfd1ae748d100f0f96ec6c9f132ce7774
SSDEEP 49152:lmd+t8NVAjXR6t2jgZ8tzPFASjYhMleFLyJwXP9L8vzbtu14BCNbTc7FBHGDDxB2:lm/nAjUt2jc8tzhYhMMFW8LMprG2
TLSH
T1F3E5BF2177C1C432D17722324AAD62BD557DB9363B2185DB63C42B5D2A708C27B3BBA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 c6d746031ee0edefa603ad42a3813d92a360a8a18aa4cf6235ef8ed1f71e6158
MD5 ba5a3f4bc4069373d590e2b8bb72671a
SHA1 c99954f05a02245328ff91f1209115eb19efad96
SHA512 b3c00bba5e64d3c56d0402020d311c02119b98216ebbc47d867c3c04e69a640d1a192c43941d728471db0624d2c0b1d39e93e0f13b45e83b7bd0a2379c5e3072
SSDEEP 192:SCx9GEoTOU3lCK1+PSSS/2zxkEfCZJrwfTwL8CNhgJU1d8FRGhoiQ:LValCVGIkEforswL8CNhwU1uFRk6
TLSH
T17343C496B804DA44EE095D769FEBDAEC3331BD26CE5B421339C1B73F86B70C00A55685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-03_5664548653709b453afef52c2afb5f71_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
Size 300KB
SHA256 250408e367365ab3dc5ae5863960f1bbc0962047948d6816d07f79c5689c981e
MD5 2f588bc880a028879fbf207d4b8e259b
SHA1 a0cba2c893e8193dd67a1643f902a7423231971f
SHA512 bd0f580a480bf6e9a373fe788a7dfff8c9e1e76dd236351baaf56f1d8078a56cf0b1a4dedc80e3c944add1044e0dbde6b7d7c60b4c351efe3f03162491b43d2d
SSDEEP 6144:5habloKMimZI46P5Bzb854fgJs3uVAOs5qiwckGIk0ggwJhi/rQx+D8X:al5MiU50jb854fgfK5qiw8Ik0ggwJhiw
TLSH
T15E64AE0276E18072E5721A325978BA7259FDBD300921CAAF23D44E1DEF31781D63AB77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3980-0-0x0000000000400000-0x00000000004EB000-memory.dmp

Download

memory/3980-1085-0x0000000000400000-0x00000000004EB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads