faabdb1c88f7dda609cb468a53e90045c42ee6bdf57c7a011dd1693a729c18d1

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 1.1MB
Sample260805-rmav1sbe89
SHA256 faabdb1c88f7dda609cb468a53e90045c42ee6bdf57c7a011dd1693a729c18d1
MD5 345686ca88336284cff32073d9298bf2
SHA1 ba33a509c18f11a98a0dcfd3863cbf12721ed70d
SHA512 585771c37011544e799ea66d83bd7cfe3dca68cff75f240f45cfa9bd21a07c8f2eddcd47eb225fcfe0bb7bbabbb1b005fea4ea1f22d05d2ee5b670b3e386a194
SSDEEP 24576:/1gJHFxFyTqLqplXml2EpC4wl5MiUOdfgiAiwyx3:/OQ0UE2L4DvAfgiAiwS3
TLSH
T1FD35CF44F6F688A6D86D1834B86FF7AB4AB97C6A8E41C92B53D01F3E6D304154932B70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1952	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX5BEB.tmp	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.ico	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX8E8D.tmp	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX7FF1.tmp	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX80BE.tmp	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX8C44.tmp	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.ico	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX6A02.tmp	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\RCXD05B.tmp	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX76DC.tmp	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.ico	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe.ico	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\RCXE140.tmp	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe.ico	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX7E46.tmp	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe.ico	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\7-Zip\7zFM.exe.ico	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX819B.tmp	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\RCXDEC9.tmp	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.ico	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\RCXB7F7.tmp	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe.ico	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.ico	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\RCX8582.tmp	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe.ico	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Windows Mail\wab.exe.ico	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX7560.tmp	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX93D8.tmp	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe.ico	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXE328.tmp	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX6C1B.tmp	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
400	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
400	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 1952	400	2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:400
- C:\Users\Admin\AppData\Local\Temp\2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe
Size 1.9MB
SHA256 ca7a6e71879c55f086b57365be8664eac781ce2ae1cf4ab6de15e858ff4ad961
MD5 ea08984729637260331a426db005a44a
SHA1 6fe2d6aeba0f9e2567369ed82794e183c5c274f0
SHA512 e080374b0f1b600d86c434d62983fee22e6ffebdc49fa37f85f56a403ca5baf55cd3caa4056798c7936de3a0ccffd7e7f5fd741555ad577ea518225bcd5e0060
SSDEEP 24576:DnoQlpS4F/LlX+cFnM3Az5/Pem0+dl6ZVP5ozP5IVJXyxR:DnL64F/L5+cZj/X0+d4/xozyVJO
TLSH
T11E95AE47B6D541DAD12D907886428176F9A2BCD20F65B6DF05B0B3297E339D83F3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
Size 4.7MB
SHA256 a0f63ecfdbe62f49b79241f1f174919cf7ea9aeb11b3c98555580a318736bcab
MD5 bc1873e954a391c15f256e9725d8cdcd
SHA1 3fdac63c266f125eeb68540068d4ae5bf59212e2
SHA512 becb15d25b702c2b3483178f16b5e8d297cf2d1e2162a879863b16ffe6a94e0cf70a1dc1ee4d49e1e06a2895e987b80ef0894a8d37741379b89d28401a99d97e
SSDEEP 49152:WFKMudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:Q3ijnUdYd+RaAj
TLSH
T1F2366B03B19990E5D059C074CE568233EBA2BC9947F161EF3690B7EA3A73AD47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 bf8375721dd1cfe39cdfb1acb1b93080d42c1b3882cfe864b8ead742aec5aac9
MD5 b80d695c91fea7f10f7787c8a65a3c26
SHA1 4d966709e0dd187b29fc83ee8e8d6cb2578ac8a4
SHA512 4307857f8d8f80dc41e8944b51d402add39e9b5eb534213b472a8d1334b5d8595c3863da79bcb61ecb1f793e742cc039ffc0ab83c0efa795795eeae4f9f663d1
SSDEEP 49152:kaK7AhpH7SZGu6qG13O7Q7gLYduZrSdHBAVfb:kahZ7CR6YjwA1b
TLSH
T160C59C07F68581FAE059C278CB268735DBA27C164F216ADF0284BA553E73BD05B3D3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.2MB
SHA256 f5e48902f85451fc0426361d4bb40b70cd7ffeaf192da51b7a18e2d3b391ee66
MD5 d7da7793420d97fbb772268a432287bb
SHA1 08453546bc0a94d92a692b53c4c8f7ad83889f50
SHA512 b8ffb20d7096dcf000f8734b79e432ebe1198f7501a5d296876c76f5acd6f0cd3aab5a9e6b475f56493ee521d3f3f4cb23ec74c68e3b3aaaf3a6f8f945b1363e
SSDEEP 24576:YaBFI5YESI3C+ZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:dBxY2fF8FhmS86IUJWQn+6h27d6
TLSH
T1B2A59D03B28A44E8D02DC075DB575D29E9A27C450B3466EF1B50F7991F3BBE42B3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 1016KB
SHA256 ba02d116f7a2673192db5ce4b77d8bd7139484c32627214c8d254e2ad8a64328
MD5 e61e38464ac573b3a2cd9dddc1c35fcf
SHA1 fa58dc4a9606e7cb702fe0393cadf6ffc6c86e1a
SHA512 792a88422536ed2fe2a17f66e4d62aebd45125da5d453c8514dcb17f72f471a5349d9704cd6dcdbe32a688c17fa1e8c49e4c71a518162674381f459207de762f
SSDEEP 12288:/QsRJoSzq0HcII3IhpXMfsW8oa+6tAl1GIKrVzkx/Fwlw5iJJ/eqxdjM35i6ows0:roSzq0HcP4toa+6tYK+l/wxdA35i6c0
TLSH
T1BB259DEC25DFC1E5F1E88EF44EC64955A6777C620D22CA3F82D4168C3D231A12EA7A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 52d50c19f984644250de27c1c0d3046343a3d4a599ebb33f2d9b090e8a3f4814
MD5 d0b395a98c5b71802000c62d3ee24f78
SHA1 cf133e2e6f1f543efdf1c78e690a328f4055acc3
SHA512 4b09b5beac27025c66bd130c15cff4838389b7666ed88b961b265a28e4c38453a70760be326f1e95e5bc2a797cbfa69ca6b4eb2ab0d58bdd01f18b080a7594c8
SSDEEP 12288:pzB0YhD9qekWNFvPECulqyWXTPlW8yqw5icJbiFEw50k9mnRT0JIxQ4ObTM:pBlhDkeVNFvU8Y8k7JEEZk9mR4qYbTM
TLSH
T11D55CFD17AC9F8A7E43A9A34498682A5D7727C4D0F12D5CF0298D36D2EA25F40E7B730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
Size 4.2MB
SHA256 f888359bd551180241bcf3b87d93b4d2da1ab7356e7c0786ed03ec95b9c2cd24
MD5 b20c6648052be22ee73fb95f0a38c087
SHA1 a84baeaa724447756bab9587427b408ccb3c8808
SHA512 07cce6c501d44314a6ef508b5d7bba57f09c168cb5a30909e6ff0f22e7bc8410d6279f01d64e8901f6273672859c1f8972fa86ec70fff2a8e586affd37ac77ac
SSDEEP 49152:RUpFa9ur01HpS2aBW08mKqRXGPd39PyPvnkSN+EcrxA3vGCDlBYMO74U2y+PhC:Sppr010bN/ki+EcF0pDeN2y/
TLSH
T127164903E19940D9D099C174CE4A9232EB62BC8907F166FF2690B6D52F77AD03B3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe
Size 1.9MB
SHA256 efe37225ae881becf0abed398344d0ca69f87742df0d589f6885723730327750
MD5 3801aaa35540e1126d938e3d84c639c9
SHA1 6dfb0d06b7470467b97a1783a6b6c58a92c78b7a
SHA512 7ba0c5047c6ea63c96444cb3782fd456a7124c2b0a6f98d8f58ed2f47eedfe35c89da10335088936d6ef3bd88a2acaedb626262cd4caac8bc49b7096ba4b270d
SSDEEP 24576:vDYQ/z1YhB+tXzuSe+jrQlWk0eTy5xDz7EqnPATW41PcL3LU:vxRYhBife+olp0L5xDzoMY91P27U
TLSH
T17795CF97B6B448D4D86D817CCA125265DA71BCC60F2467CF8680B2893E77EF06F3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 5cde8289899f976237b1a4854416d1996a7e92ad893189c3815f4a96e7f47d11
MD5 9c30328ce67395b073de80f3b88f37de
SHA1 ee905c16704b6208be7784758e21dc847372711b
SHA512 7df6827daf04471bb330efc7d41b094265388baf68d530060a3681e22d84905e677d5b01fe1c6d6ad32d864d2b08f6285ff9044e9bc1abf4927af6423a3eb785
SSDEEP 49152:oMSK9MCp56XcfehjvHHKTdfxINPEt99G2Bo7EukU1a:oDKqCvxyjvnORmE
TLSH
T1E6B5BE13B2DC80E4D01DE174C646DA72DDB2BC5007296ADF1380B2295EB7AD6DB3E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

MpCmdRun.exe.ico

Path C:\Program Files (x86)\Windows Defender\MpCmdRun.exe.ico
Size 3KB
SHA256 02221d573edefa486ba8fe5aee3c8a10c8c7e3188914c0f22df06bb1338db790
MD5 1272e6501512e471bddb879dea4b5800
SHA1 1c8b9489166959e6106095c0974a1825ac1179c6
SHA512 7ef9f685457532d84ba2ed316ec52a44acec151b92e563f6943f593d272745bad0f7c549867a723d2b3532cbcb76ea2b99a965b3b2412d5e7644570740bb4194
TLSH
T1CF6140A1F209FC58C45CD1744DC6C2CC18543D958C0A7273FADCBF8F69724E52E21181
MD5 SHA1 SHA512 TLSH

Submit Download

RCX5606.tmp

Path C:\Program Files\7-Zip\RCX5606.tmp
Size 796KB
SHA256 4f24e68d4730f2e8db043564dd387d90bc4a45c9a7ba49616859aabb9077711f
MD5 a66855eadbeb63a97b3db2145abfc396
SHA1 b1f35f70ab3e8864487788f0c1408a07fb887dfc
SHA512 4345a18f8587a4661734a7ef17ac37ce52481399d95d2de90f2d6fcc6f35962b9e66360991542a0f1371b5fc08260c8196e45cd80dd459ae64d0f4c7d0ffefc2
SSDEEP 12288:/1gWgbDFxFyTi0rqL7Hm8kxkwhXp0l24qw5i8CZXtv:/1gJHFxFyTqLqplXml2EpCb
TLSH
T14305AF48F6FB8C9AD84C1878B44FF7AF4AA52C9E8E41C92793D15F7E2D2041D4972A70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 463b6e99198762de39ea3c9156504527673355f452c17063d0fcc34caa3cfded
MD5 01f2c0d2e4df4e0ed544a4e4600d1457
SHA1 2bdf43857fcfeefcd37ee7a82d733ca4e4f1d871
SHA512 8238557d4075faf0d780ce775a6bc0121cf2da9b826cc49095fec9b35096809e5187f3027682db88d7358e21025c5d24d2ef784e9c2b0a8aa7021589ce68a8aa
TLSH
T13061D3A9E5052C3BFD5CDA7935B6DB60C2077ECA021680778809F58328F768B16ED974
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

iexplore.exe.ico

Path C:\Program Files\Internet Explorer\iexplore.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

lyncicon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe
Size 1.6MB
SHA256 b9c1f64b6ca6a11a6270bf91baa72fccf502dcdbc24ebcad8e054558c11b16d8
MD5 16028e7348864bd508866075148d06d9
SHA1 2e112ac774c539d77124478f9547781900b7433f
SHA512 db60e5c61d57551c6b38199439bef5ba3d605768082ce9bc503cea9ceb7903e1f0e2caaa4387e964d4f756266714951342af69c3ff551a6c9ff142424285d1ba
SSDEEP 12288:aRPvI0Tl0OwU4+wGd8OYNoiJFjlJSTyBhV45BQ6utotxUriXZszOFmw5icufe+:aFg0TOOwUGk4Ff4COUeXZszOFzEW+
TLSH
T1D8754A45A51CC4C6DC2E0E724B91A970F9622EEFBC3E35096C80B2AB55F7CC467125BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 1.0MB
SHA256 6c4f73702d55232082b671fe5bfc4cf58ea9ab8f73c315e1d068c90f55a2c102
MD5 5c231d73d17a51573626bb58dabfa801
SHA1 1bb8b30888b5119f54c7b33e219e2ff801432fd2
SHA512 154602c1ed91ac6f0a00eea4bb9be24887ad91dc0a7e0551cdb6bc1107c35258c721ccf79da26fa8d25877b9159a7ccb51fb6e8897a9fa1358f1a5ce81f4778e
SSDEEP 12288:ioKv9kPtgRTTTOaOKk8VBV5cKTofRcycTPDw5iDTxi9Vjzi1XLsswWkxy2lRq2cv:i7UyRTTTOaFHVX5cB19VPoXYfDtczAe
TLSH
T13235B04E3B809B7EDAEF4E3486D5C652C2637C12D921C64B56731E0E1D7318A2ABD3B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineScannerShell.exe.ico

Path C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe.ico
Size 3KB
SHA256 9e3f1f8e5166514df44b02a1e0bf7474708dafba161e263cff087af62ba89ae5
MD5 d8ef82bb84e2efe95de666f46d0c7ac6
SHA1 fcdd2f6ceacde21e1e38a687041138aa5bb0ef68
SHA512 61f7439ba615c3250701aeecb96ab8319f2d84ffa7e61076f6dbfce20ee3409d212e8d9deb274b145b7f0eeed2388681b929ba897bc85b4d3841f7003bc40afd
TLSH
T1C461FEC2D34610E8DA8268F34DB58DC487650CD540E4ED920EE6BCE39A745FDA93188F
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
Size 1.4MB
SHA256 ad074d7ad04ed0769c8a5eca9bd7dcb20870f4c202c55d68b5d870c0a709435e
MD5 c5aa6418a07c2568372d02453a73397c
SHA1 383ca875d947659d1d089a4af33da74467ed128c
SHA512 daa48a7f4347c7e477681498a2b9d21f59f903fbd2dd4a18295ff3ffff070371882158bd414df879a0e910c3b4683c5b9a8d70288e509f6e1213e5ea353d57f8
SSDEEP 24576:dMPI7hOb0CaRwXL6MbYZVMysZgjS1hqgSC/izGfU2JGlbhlAZ4/:dT7hOXL6nVRjvQo0nGH1
TLSH
T15865BE35B4948023C2BB19FFA55F91B06A3DEA242F45C52B72E4A81DFF790951F33226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-7.0.16-win-x64.exe

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe
Size 1.4MB
SHA256 b7841b6fd9703bca49951314c3c449a8927ccaa47a39c81ed57d6b3efacdd29d
MD5 b10a88b67b93c7eabecf3f43b9d2a579
SHA1 758b1c06614bddf8195c913cdb2ebd89537c3276
SHA512 a34be759289fea1057280396e33dfd1c3abe32c19d4b04fe9f0751e55df5e53038b2552e0273fb07d926390a54211f2ae3361f13523bcbe08b5821877e588231
SSDEEP 24576:rj0dqFodwY2cH8h20uURtAroC+poKwT9gGh5mWpI2jFM5sFzfTpi71R8dZd:kdLankyR6rNeGh5BjBbTpi5R8d7
TLSH
T17365CF797AA0507EC6F80732E838D5B12D64EE955B40426BDFE0B90CBDB4840AB77673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 27.4MB
SHA256 e41fde2e05da25badf655e854b8e263e92abc2384222db44851934478eb85da4
MD5 b9647665617f991ac7551f40b0e59a84
SHA1 4791856e68abd4d04710c08b86275eb856b0647c
SHA512 bab510af7ef83ebbe21e7cf3018e3c9a8f7323d79923f9683a09505a2d70baa89d252241f051beabc60df3136c8580604c6446e00305d26f0114e8899cbac23d
SSDEEP 393216:cBc50vw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vXL:Ac4WO1c877xqpyovvVWJ6VFK+q3cSvXL
TLSH
T10F5722927FE89071F1B706307A79467D857B7C319B3191CF2286F60D1978AC19A3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 96ca972e8a2694115f9b91f39a3d12a658b20bb470f8b191ff404be9aff96ba5
MD5 e8ba839bf784c480a71934171295f2b5
SHA1 9bbbf0fe3d77363bb6b2f827ee5f2c2a667c689d
SHA512 8d4fbdb3c956deb54e9b737fc3a4a1edf0e46df9ec56cdc5156993daff3c6983ff2c50c1109f36ed32f57a944edf117c4645d0f50b296e8394caf0f1e6025714
SSDEEP 96:6JdKVEYeHyScK9PIvGsr6uTeiqUsmPG1AfUAWPr94R78eMFau:6JsVEfQK9PIOG6uZv6AcAWT94x8e7u
TLSH
T149D24256B404EA12DD0A2C32EFEAD5EC33313E25CD9A035779D6B7BF49BB1C08868549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 28e7687210fe6ac9a5d44280e697d6fa0bf5eff85f17d32e95851aa10e0a4bd5
MD5 e6dc0e9ed9b592662d3267c18017f114
SHA1 bba7da59da000f37f47f4c149127b064f4f0a1d0
SHA512 3fc3f559859531bcc6d4b631d1b4551329fc6b00beca26c6785287a3d34987d59c56e1f354505ebc12e687dc17a8f63c72dda31321b858de687b4b7cdc2ada20
SSDEEP 192:kzJsE2MK9FIO5iuHTW4A5DvOXcHDmGn7oP:kKlKlDS85n7K
TLSH
T15BD28556B844EA16DD092D329FEBD4ED72313E26CD8B035379C2BB7E49B71C18D68089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-05_345686ca88336284cff32073d9298bf2_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
Size 300KB
SHA256 454309c0d5f1ca1969a87f6cb56b2dc45299acc1312b812391ba5f25401d4aa2
MD5 f9d2f4f73214193acd8d07cf3d563604
SHA1 0387e86b28e7a7b63fecdc82394147cbb89d16a9
SHA512 4d05f174a6cde5d24de4d3405bf62582d820b868d1b8d260b734058acb7a78fcc19799ad835aba29db73f9e929cf09f886fa1045f2e8b581cd47dbdfab5f7f6a
SSDEEP 6144:5habloKMimZI46P5Bzb854fgJs3uVAOs5qiwckGIk0ggwJhi/rQx+D8:al5MiU50jb854fgfK5qiw8Ik0ggwJhik
TLSH
T19964AE0276E18072E5721A325D78BA7259FDBD300921CAAF23D45E1DEF31680D63AB77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-897-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

memory/400-0-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads