af342f15f20450f44f13a8351c11109a7c9b1342a1aca119b9d45d0905790949

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 1.1MB
Sample260810-wszhsavbrf
SHA256 af342f15f20450f44f13a8351c11109a7c9b1342a1aca119b9d45d0905790949
MD5 d4d3009be1736977da4e72abc58fd4f4
SHA1 89d90b6cb263bfd8593973916a2a5418d914054d
SHA512 bf0e00bdf212236bfba1670d2ba69dbda0c5d094317e4b265b9eb7ea96f2dec72e70fb7e038345fdd77245fef5d6cfe528635a4703ef968a1337876ad2d3950c
SSDEEP 24576:UU8K0Xet5ctusNH3pQ3OMk5a8l5MiUOdfgiAiwyx3:UU8K0XysNZ8OMvvAfgiAiwS3
TLSH
T1A535BE847AC5C876D01B0636C43C8AE98AB9B9CF48077D4FB39B972C2D30A4E656177D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4168	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX4F53.tmp	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\RCX3C71.tmp	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.ico	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX4849.tmp	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX4E36.tmp	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.ico	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX474C.tmp	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX47AB.tmp	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX57A6.tmp	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.ico	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.ico	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.ico	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX4110.tmp	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.ico	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXC065.tmp	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX417F.tmp	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.ico	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXBC96.tmp	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\7-Zip\7zG.exe.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX3190.tmp	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\RCX35BC.tmp	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.ico	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\RCXD276.tmp	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.ico	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX5738.tmp	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX2BE8.tmp	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX58E2.tmp	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\RCX5F4D.tmp	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5180	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
5180	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5180 wrote to memory of 4168	5180	2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5180
- C:\Users\Admin\AppData\Local\Temp\2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe
Size 2.0MB
SHA256 7b9917f547a18ef44140cd16a445f5f6621999f4e06c0dd2e6ce67aea05f6949
MD5 7eedb0129a3a54d1e3fd802f3bb594bc
SHA1 779aa9fbee005b03903e98bd4dbf8a35937223a5
SHA512 577319f9ce8ab0e1b3f5e04c3fcbdc886187b1712bae0c89a2f73262d2fecaa397bc824456a89f05e4128a5ba73edaa2219c263f2b4191e1b4806eedb529bcce
SSDEEP 24576:uu9lzITFU4SCUcwMqALz5/Pem0+dl6ZVP5ozP5IVJXyxR:4hucs6/X0+d4/xozyVJO
TLSH
T14995BE0BBA9045E5C42CC87486068975DB63BE052F21EADF0690BA1E6F379D53F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
Size 4.7MB
SHA256 e4125dff02e6467b90b7a5eb3b301ae497d9a030b64e5d92d4a7baff2cff865f
MD5 5c0051a5c0c458068d3d8e8ede076ab3
SHA1 832d9f524eec4455587689119ac6b1d5a9a92d70
SHA512 3a548ab27c70b80e481d2353aea0622dee6c4a655bcf79e711ebd468b13ff7e0000f5bf564ce8f47b8931a5d390bae66a736dad5b6e79e7ad05600d34f782a5d
SSDEEP 49152:JurJNudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:gr5ijnUdYd+RaAj
TLSH
T16F366B03B28984D5D049D574CE46C232AB627C4A87F162EF3690B7DA2E73AD43B3D725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 222245c3eb93534b56877c4263c8479fd68b4208e8f4e611fdedbfe4adaf2aa4
MD5 7ff677c6cef4ede2a4bb05e78b095fb4
SHA1 eacddb71d4b86daa91ef2aa76f20848d3726bc03
SHA512 32f221a53f229f654f7870f6636533bbfc7e1f8d60f5d86f76aa43fddbb8594f174d63c6c94c026b7071d4f5ab4045208df9bc28a4db1f6911a7227473b54216
SSDEEP 49152:0RVoa10s6B01XPvZGu6qG13O7Q7gLYduZrSdHBAVfb:tixR6YjwA1b
TLSH
T162C5BE07F685C9A5E05DCAB8CA22D725DA617C656F316ADF02507B162FB3AD00F3D3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.2MB
SHA256 69c21ea5b5ea1624224262e6c0d7f41afb837e02cbb1365f6fa4f6921493b879
MD5 ca3f2ab7518ad5f64a9a1596835fe48a
SHA1 308202bdb8316bef9e544a371941d76881aec9ac
SHA512 12edcc2c7ec16f5e438e4879de0763eb52d19b94f33b2acc358cba399ed45f3a5ba4562d4565be9c0560396283eedce0d4c4012d50efe36f7bae1786f87938e2
SSDEEP 49152:NSD/70HhPKs0u3JjFY2fF8FhmS86IUJWQn+6h27d6:N2z4pKi3bOjjsts
TLSH
T189B59D03B78A40E8D01DD4B6C6068636E6B5BC45CB2466EF0B40B65A1E7FAF55F3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 1.0MB
SHA256 e5afe4d7f51c2c52da97412baccb3f3fbc702b5f792e56111453dec0aadbb6ce
MD5 29bf8a54bbacfa97785eb97fd2c08488
SHA1 78128f0e05d147caa69d1fd7f42b0fb786200c20
SHA512 f14e9e9e2762a2190bd3a7666a021c31464f5aacbb0e7d4c7a0d139262f0441e755b76e8fcf8c87f32a507663e04b3c20f700d6849947d2f3e5457538ce16e43
SSDEEP 24576:93Dzh0sAMPtUej9jnWkbPn5ytnfIU766666666662bA35i6c0:93/XAMPtU29akbP52QUOUpX
TLSH
T1A335AEF470ED49B7CA25B172CB814AF2D262FC529D40685B427DB60D2E29B434D36BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 481d4b36e70224ccc30536f141267b56ddb8918bb30e46bf0e32448f3c4e10c3
MD5 cd528ab5127b5713cbff63bca8a010c0
SHA1 9fb3592fedaceefb56bd22d6190fdb8b3e01df47
SHA512 b8c3b2936af485ec999b58124753e3141a51f933b8385f3bb88a8ae94e4ee33836f77405e3b29f202dc050f97ce9c4a1293c11ccc678c6753678cec89d2b8852
SSDEEP 24576:hUednKNmKlFHX3bEQeUV1sDk9mR4qYbTM:KeA0wxX3bEQZ1zmWD
TLSH
T15755BF09B5D689FDD0594BF0C64B8FD59433B8B24A10628F3290A96CFE37E951E79334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
Size 4.2MB
SHA256 da65a48dd9610c1705197a031497573f53ef165e85f6a577309cbe6ab48b004d
MD5 de7cc87349c30f115329ddd90b7d8fa5
SHA1 c1d5ff2cc2a5cc56334f6723d7d8efd8cb0f546c
SHA512 bdfbd362f2643aeca69611838ed6ebf3d4fcca22eb4764b89955ef89cff93ed7a4722cd18af0f62849ff7560963d3b1b6ebdc2afad2ae381be2258787aa8b62f
SSDEEP 49152:Xgk3KJNgCL+kBKS2aBW08mKqRXGPd39PyPvnkSN+EcrxA3vGCDlBYMO74U2y+PhC:76JmCLfbN/ki+EcF0pDeN2y/
TLSH
T18D265A03E19510D8D059C174CF8A963AEBA2BC8947F162EF3280B6D53A77AD07B3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe
Size 1.9MB
SHA256 0c639ddebc61c25e19b06532a6f66eb8094ac9245dc1c35c6beacc00dca40018
MD5 ed4c3ddb67cbc95337b483b3b9f12761
SHA1 e991d0eebf61165998851703c4a96e3621f278a8
SHA512 846a4995fb5cf449d9aec57201ecdf614105a36399beb398ea473f24b2e0eb4de8af550fd4f08a958e8b4c3b6fe38eab416b875291436f2a7607c5acf27f46ca
SSDEEP 49152:Oedc7Eb7+a37IbEnKolp0L5xDzoMY91P27U:OedcYb6a3vKupQrzoJA7U
TLSH
T1E595AD03F7A588D4E01D807C8BF68175E9617C9D2F2566DF0698F2182E77AD4AB3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 9738c96c22738fe8008a7db5cbeeae5ec419bf9832b074cf9060ae18c4d55512
MD5 7e92f00f98196186988a48a22c0586d7
SHA1 9e9e1b7a28402a25ab660216015ee0afa4673fbf
SHA512 a1bb59db90aa372dd88cf46412398c7cb2a56019a7f1072827ebfe8c468f2ef78106b121709e96a62796e009aeeee908c16b8fcc04ad3326d05c91413fb68498
SSDEEP 49152:zvb5pYyuGNcifehjvHHKTdfxINPEt99G2Bo7EukU1a:zvb5pY0NnyjvnORmE
TLSH
T18FB5AF13F29950E8E099E97CE6168D35E9A2BC058B25B6DF0744B3091F77FE05B3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

MpCmdRun.exe.ico

Path C:\Program Files (x86)\Windows Defender\MpCmdRun.exe.ico
Size 3KB
SHA256 02221d573edefa486ba8fe5aee3c8a10c8c7e3188914c0f22df06bb1338db790
MD5 1272e6501512e471bddb879dea4b5800
SHA1 1c8b9489166959e6106095c0974a1825ac1179c6
SHA512 7ef9f685457532d84ba2ed316ec52a44acec151b92e563f6943f593d272745bad0f7c549867a723d2b3532cbcb76ea2b99a965b3b2412d5e7644570740bb4194
TLSH
T1CF6140A1F209FC58C45CD1744DC6C2CC18543D958C0A7273FADCBF8F69724E52E21181
MD5 SHA1 SHA512 TLSH

Submit Download

RCX2BE8.tmp

Path C:\Program Files\7-Zip\RCX2BE8.tmp
Size 824KB
SHA256 764dfcc4409e711c2c4b187828a2436437a713e6c7312c0a291747019ffdeba2
MD5 03a7fca7f38da58090b7bc592f41cc4f
SHA1 2afdfde97d3a0d8f3e344c1a1de8e1c45929b7f0
SHA512 88ad9aa68ddd246d273f6c249135cf9b54fdab73c14c572bad69ff67dbc07ee5aa5c1891da333db561a0e6251fae0e85b90b2457b85a861777796347bc6ccd95
SSDEEP 12288:UU8K0XgxO25cC1C760kbWC8NQ+3pQ3OJ6/88w5iNi72R/:UU8K0Xet5ctusNH3pQ3OMk5a
TLSH
T1F005AEC8AAC9C87BD00B467AD43D4AED86B5EACF440B3D4BB25BD32C1D74A1E255067C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 463b6e99198762de39ea3c9156504527673355f452c17063d0fcc34caa3cfded
MD5 01f2c0d2e4df4e0ed544a4e4600d1457
SHA1 2bdf43857fcfeefcd37ee7a82d733ca4e4f1d871
SHA512 8238557d4075faf0d780ce775a6bc0121cf2da9b826cc49095fec9b35096809e5187f3027682db88d7358e21025c5d24d2ef784e9c2b0a8aa7021589ce68a8aa
TLSH
T13061D3A9E5052C3BFD5CDA7935B6DB60C2077ECA021680778809F58328F768B16ED974
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

iexplore.exe.ico

Path C:\Program Files\Internet Explorer\iexplore.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

lyncicon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe
Size 1.6MB
SHA256 1eb814de5b8cb99385a69f07b4b2a1cd8c8a2e4f963cddf3eeb2206adbc5f0bf
MD5 43c5998de2435f90e6bb070f5ca402ec
SHA1 93ae7837f07468b813f90555f84ba412d65173c1
SHA512 cf93d6f23870f7ab34ec9e59c88bb5f0990b6aa8f8a2669677a992f1d58ce8fb36a9175a16d4f98ad4bac90293df552b33da08614a532d114bcb497fa469788c
SSDEEP 24576:eIklFLmGaej4sefGi/RD6bedNZDd6Prq0hUO53mNi+:RfGi/RXFUN+z
TLSH
T15675179978588A25DD2D0F38C745E571FC13ACDFBD4FB0092F08B62A25BB5F224916A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 1.1MB
SHA256 5c16dd844de27ba892c2d6d4ec73a4762c5233454ba13383b64961e20386e2c8
MD5 b2099a7e19818eae677441312c383e1a
SHA1 5f242845ea9119bc2dd586c8a02a663f1cf5d419
SHA512 1b5c0782917909c36493c409cf29d1fed618b8041ab3d8873bb1060273f4495bb67530a4f908f4ab2ddc9e251f46cf9a7b15a8ea1820c9ad6cdd632d7ff3f824
SSDEEP 24576:/Uy5LxLP3GsDsM/keQBFLL0rm/XYfDtczAe:/FFsgPQBFLAFtcv
TLSH
T1FA35BE47F6544CFEF98904747A714BA6F6227C1B4672A50BA280ACDCBE23FE46C35364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineScannerShell.exe.ico

Path C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe.ico
Size 3KB
SHA256 9e3f1f8e5166514df44b02a1e0bf7474708dafba161e263cff087af62ba89ae5
MD5 d8ef82bb84e2efe95de666f46d0c7ac6
SHA1 fcdd2f6ceacde21e1e38a687041138aa5bb0ef68
SHA512 61f7439ba615c3250701aeecb96ab8319f2d84ffa7e61076f6dbfce20ee3409d212e8d9deb274b145b7f0eeed2388681b929ba897bc85b4d3841f7003bc40afd
TLSH
T1C461FEC2D34610E8DA8268F34DB58DC487650CD540E4ED920EE6BCE39A745FDA93188F
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
Size 1.4MB
SHA256 0d04c8dfb7d5ce25c0e7f0f9e1f60d1a97469865a46cba22516bc88958507409
MD5 2dad3e33985b41f8ef27ecff91b8a700
SHA1 02b1a4f3bcdf887baa453f88fac3f44c324abf6c
SHA512 f56d34f646ac7c62e0eee542657b02f63219b456258a3e0b81b653e7e67cefdb758fce712e95d4a0986b79340d86f21dcaaf3401e7800edf4ef670e0d90238a0
SSDEEP 24576:x+Xeyd3CCjse+JBy3yrV226TwJm7WMysZgjS1hqgSC/izGfU2JGlbhlAZ4/:4zSJeQy3SV226TamCRjvQo0nGH1
TLSH
T1B165C036B0D44C3FD1A409F3D858923C7EBDE5249B15849EA2F4ED1E7970072A6B33A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-7.0.16-win-x64.exe

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe
Size 1.4MB
SHA256 dd86017231ba7047b7bfce570932670b69d3867904a74080a891a829c3a9e29e
MD5 15fee44a1f3ce230c225acb74f778a41
SHA1 11297ea5167e4f138c656bde39e89b5b34d9ffe2
SHA512 004c29c00a6f143d94484772c8919980731912ca4c050ae9122b4c59d52e27e9dd0825c4238d7ad4a0cfcc3d0bdc8dc4758ea4a68f555177807a7678bc39f703
SSDEEP 24576:Oh6MfhcVie/gHAJF1hqZoiBLlb5mWpI2jFM5sFzfTpi71R8dZd:OvfKie/g6F1hqVhb5BjBbTpi5R8d7
TLSH
T14465BF35A0CE8532E6B1063264688FB36CB9D70C1B5164E7F3E2B90D7D6E64126B7336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 27.4MB
SHA256 eb5733f6d0f2aa75f70b8b0a88421154c3d71f7f489da126cc9ff9113ebb6b4d
MD5 d32c09cfa03d093a275979ae17189557
SHA1 d48e50adff12e9a252ba045689ce947b3b84662f
SHA512 144e886d4386b8dda6b61db5daebb5c4d219477d112fa5eaa9c7278192fb67350f56f2e9b726f2ef9a8613679ac4bd43eb7a14152ee17ef4ebe9222da94b9cba
SSDEEP 786432:tcYZpWO1c877xqpyovvVWJ6VFK+q3cSvXL:tcYZ8O1b7xqpfg1+A
TLSH
T19E5722917FE8A471F0B32630B974567DA5BBBC325B3591CF2246F10C1A709C29A76B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-10_d4d3009be1736977da4e72abc58fd4f4_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
Size 300KB
SHA256 ab8f4ad8fdfbdf52d56b8cda1b030b3795c3e5298a5c1fbf5d349acc500a1f65
MD5 daa46256e79be25c1b10601c0bfe2854
SHA1 3321109ba424ae1fe7ba34ec6d1aad76874a1b15
SHA512 14ef545a9ba30888486b297b391bed6a2641346d7b51b964697bf80717962549e3cb29b0eabbda31e95fc467a3dfc7d6bd6b49d5258f7cfaff8968855e5ee78e
SSDEEP 6144:5habloKMimZI46P5Bzb854fgJs3uVAOs5qiwckGIk0ggwJhi/rQx+D8:al5MiU50jb854fgfK5qiw8Ik0ggwJhik
TLSH
T1C464AE0276E18072E5721A325D78BA6259FDBD300921CAAF23D45E1DEF31780D63AB77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5180-0-0x0000000000400000-0x00000000004F0000-memory.dmp

Download

memory/5180-738-0x0000000000400000-0x00000000004F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads