8d76c6fdf1ee3a2f4d46ae4349f91da2af4b1d73ef64be8c5fd899f46a84b91b

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 00:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 1.1MB
Sample260813-azzapswybw
SHA256 8d76c6fdf1ee3a2f4d46ae4349f91da2af4b1d73ef64be8c5fd899f46a84b91b
MD5 8f00a2bbd9436e8f1d91d4182e33861d
SHA1 ec33a227c17f92286bb641974d0f23bb49c8e981
SHA512 15a575dec9b7d371f7fe31bddd20ac07ca865451328eedb470e27c6a0cc2677fecd914feebb71eba456b85e331cb3ea6bfe6b1b18cecedfd527606cba18a0a89
SSDEEP 24576:jx+RwLresoAQoCquOwBOC2l5MiUOdfgiAiwyx3:FfeqdgOAvAfgiAiwS3
TLSH
T15A35AE3D7BB1C8B3E034CD30786987781D393C6119167D2F42A07B1E7DB6572A92A63A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3348	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\RCXCFD2.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX915F.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX9971.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.ico	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.ico	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.ico	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.ico	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXA02A.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RCXABBC.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.ico	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\RCXC587.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\RCXD9EB.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX9CA5.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXA26F.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe.ico	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX819F.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\RCXC6C3.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXDD68.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\RCX6E05.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX8428.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe.ico	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\RCXFD31.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\RCX160.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE.ico	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe.ico	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX645F.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX8B12.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXB1C6.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX6383.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCX878D.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.ico	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCXD4FE.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX8141.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe.ico	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX9FDB.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\RCXAF2F.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX66D5.tmp	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe.exe	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2004	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
2004	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 3348	2004	2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe
Size 1.9MB
SHA256 75d08b9593e511d81132c485510465c5aabf431dc3d73cc3da73ef4f0925161e
MD5 80bbca80e678f6507cf2e6d0be394703
SHA1 1ef8cbe413ff6c6232ca8ed45d158c8e9c272fd1
SHA512 d09109561c6b4322bdbbb22125a0ebeefbc1cefc06f20417bdc863cace500df919397b92aaef539229eac33978ccc22206cb5616c32152a5e209238832f9c300
SSDEEP 24576:A7297QQlbUFdq2/ICTukcjUC1K08z5/Pem0+dl6ZVP5ozP5IVJXyxR:NPU2kuVdK0c/X0+d4/xozyVJO
TLSH
T1ED95AF0BF29588E4D02EC1788E4741B1D6F1BC5ACF6996CF0690B7382F76AD56B39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
Size 4.7MB
SHA256 fd048b226ad710751ac609416893d386bcaa8f94cbbba444b4587a72328a0450
MD5 1f88588aa8d026ea8c1395cb8ad781fe
SHA1 fd1196124213db3b51c7f23ad69be9ab4ab22ca7
SHA512 6f3a490d50e5fd3a75d8b30fd96518a334042eff0d30fe3b1641ac310383708c36035d530bccf7ebff37c3551f01790d692df6d41db073868439f493e6e4960d
SSDEEP 49152:AtSPFWFNZiobudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/BG:AtSPFWFNZiWijnUdYd+RaAj
TLSH
T163366A43B28940E4D099C174CE56D232EB627C9947F161EF3690B7EA2A77AD43B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 08720ff3dc8bfd19948e53b84eda0e377e86938c5e321f381c4263c95a3045c1
MD5 9e297075b10a2bc761fe6486d27ba0fe
SHA1 07297cc7caf0cfd7799a34a0c35f435b357885da
SHA512 19ec3ecc76795da076a12550a2090dfa4ff68d07d3a6344ae0d3b8002b39165e2dc1c89c63c393b159212cb352cc7b619cd07a466a7adbca896dcd463639370b
SSDEEP 49152:MM/9FHqZGu6qG13O7Q7gLYduZrSdHBAVfb:v9FHKR6YjwA1b
TLSH
T108C59D03F785C0A5E05CCAF98A2A8725DA627C574F24D5DF0290FA157F7BAD01B393A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.2MB
SHA256 5cfa3a20e650ef14e327f77dfb2dff93cf6ea4dbf5ae99aa8d964a9e7782ed51
MD5 2044a3c68af612ebe182758bdffdd234
SHA1 421e377461dc8e7732622c4b863e24533e0cea43
SHA512 899fa3bdafcecaa23ed15c885456f77b7968a9116956261574b0c0946e1377b72c3c081f3013a2e212b3403fb78056e797818fd08224c2add09b9c6522a650fa
SSDEEP 24576:p1E9vFt0Ck0eqwlLZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:OalEY2fF8FhmS86IUJWQn+6h27d6
TLSH
T196B58C07F39940E8E02EC1B6CA5A9939D9B37C450724B6DF0B50BA762E77AD41F39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateComRegisterShell64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe
Size 1.0MB
SHA256 b54fbc53e984103b38e52bc2debe4dd9f947e388304ef738f0752c015576f086
MD5 02ddc6f6d59671e90fb28ec98c888a12
SHA1 c1ba595f0135d92b08dfda50a01169f0b16a6898
SHA512 4373f4b0dfaf9594ce2c26d966a66dd95cb918f0729bc5e79366bc19821f30f9510be2ff171c70449082eede0de2a06865614bacf13becadd0846cefc0076896
SSDEEP 12288:7It5rkGsc6Uf/+dfAfPtgd66rKI5VrT7E6fbsYh89irPw5iSNRsReWSYM7jM35ik:7gdgwFtgd6Kfsiw7fsReZlA35i6c0
TLSH
T12A25AF7D359584FAE02494358BF6D650E13FBC3226404C6F72996B4BACE14C1E8ABD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 3a8797440908d107ed715ae5006b117bca3c0427f19f37091b61e505f92e376a
MD5 fee0d29709b190a089dab96dff3102d9
SHA1 5f687330add21a0599f44d86f6f9e5a9bccfc923
SHA512 61c5a37d4dbe00af15fa3776cc076d7065f7484c70abd31869f36553d7a92460ed28077c75e46be448fe6a059d4c3381d5a4f66e2dc9fb0a8714ec2cf99d4f65
SSDEEP 24576:2WZtep6iEtvVZayf11LJvQRHOk9mR4qYbTM:fhNtvXxLqRHZmWD
TLSH
T18955AF05798058E1E02CCA344D4601AD9BEB78524F02995F0B96B6EE2F3E3D5BEBD770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
Size 4.2MB
SHA256 22a2730655e0c74e5d89eca87082d8960b0aef6859f1769ef6889e6da1ab6c5c
MD5 8c23bb8ef2e59c68c8295f41d985777e
SHA1 92342bc095dd49caf31d6c087481a9171ef3edc4
SHA512 1fe0cec3125f1f7f89f9443a7399d455f15ed646bb9c5bbb3c1b50dae20af715f95df9c6a2356a730b0cee4a5465acbf7a7c84ffbf08becbd9f4bb1a05c38d26
SSDEEP 49152:bdMvnmsc0w4S2aBW08mKqRXGPd39PyPvnkSN+EcrxA3vGCDlBYMO74U2y+PhC:J6msc0wvbN/ki+EcF0pDeN2y/
TLSH
T1F8266B03A19940D4D099D174DF4A9232EBA2BC8947F262EF3650B6D52F77AD03B3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe
Size 1.9MB
SHA256 b0529dfbb25f3e18745f1ed4aa1a3390d86a9c28994928919115186d219c3247
MD5 46ec87527e1861639c981375f7181e5d
SHA1 917595491017b922b9828eea98abeeaa87a21e25
SHA512 7b586604ba291c82f67ff0d5edf99aca3cd79769656ef3f7704696f943297eaff24dd5e275fb922d84a08f43a6bc960fa02dd55167c9ef371c9c4bdf099b2039
SSDEEP 24576:Yjg0LsqVHL6/hVX8TECoEFdENXlWk0eTy5xDz7EqnPATW41PcL3LU:Y3s+rE3eENXlp0L5xDzoMY91P27U
TLSH
T1C095BF0BB59554E4C09DC0719676917DEAB27C9A0F3469DF0260B2883E3B9D41F3E3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 efabb3d3752b31cb7e8c0dcf2de2205178155130b7babf419dd54c343bc7436b
MD5 6ac3336dc245c0deab0609f29c939353
SHA1 5a76ef21b8e909db9b16a55ad86cd63818113705
SHA512 5b387b7a350579e7eca79585b68b4d9b37d205b1a5849869579855cb933e5d58483fc44eb4f5625f279e78c4ac929839b1135587b51291d09bf5c9cb544e1009
SSDEEP 49152:dfqTwBDco2AlXNWjfehjvHHKTdfxINPEt99G2Bo7EukU1a:dfqccMXEyjvnORmE
TLSH
T1B2B59D03B39885F4E06DC1B4E6169B65EAA3BC060B25A5DF0780B74D1E3BFE45B79321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

MpCmdRun.exe.ico

Path C:\Program Files (x86)\Windows Defender\MpCmdRun.exe.ico
Size 3KB
SHA256 02221d573edefa486ba8fe5aee3c8a10c8c7e3188914c0f22df06bb1338db790
MD5 1272e6501512e471bddb879dea4b5800
SHA1 1c8b9489166959e6106095c0974a1825ac1179c6
SHA512 7ef9f685457532d84ba2ed316ec52a44acec151b92e563f6943f593d272745bad0f7c549867a723d2b3532cbcb76ea2b99a965b3b2412d5e7644570740bb4194
TLSH
T1CF6140A1F209FC58C45CD1744DC6C2CC18543D958C0A7273FADCBF8F69724E52E21181
MD5 SHA1 SHA512 TLSH

Submit Download

RCX6383.tmp

Path C:\Program Files\7-Zip\RCX6383.tmp
Size 804KB
SHA256 91cade3c8f1f5c058e2ac2194e36ee0f583d872579fee030bbbfca3b266867b4
MD5 9f1f4059456f5adba23da3cb656952bc
SHA1 fd37bb0c2ff80976aa6648760789b376bfd39b4c
SHA512 e7054392a88861334439b449d1f12488b8288dcb99b33b55dce49545d5bbea08d63d90750ffc7fe3b117d07a9e5da02b0d86efa3e1e2a6effa62e24c85673141
SSDEEP 12288:jeU+EUJwLFJ3usKdAK2QwiKow++SPgTZuVPknBQew5iwF8C7:jx+RwLresoAQoCquOwBOC
TLSH
T11A05BE3DBB71DDB3E034CC74746987781D312C61290A3D1F4560BB1E3CAB57AA96A23A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 463b6e99198762de39ea3c9156504527673355f452c17063d0fcc34caa3cfded
MD5 01f2c0d2e4df4e0ed544a4e4600d1457
SHA1 2bdf43857fcfeefcd37ee7a82d733ca4e4f1d871
SHA512 8238557d4075faf0d780ce775a6bc0121cf2da9b826cc49095fec9b35096809e5187f3027682db88d7358e21025c5d24d2ef784e9c2b0a8aa7021589ce68a8aa
TLSH
T13061D3A9E5052C3BFD5CDA7935B6DB60C2077ECA021680778809F58328F768B16ED974
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

iexplore.exe.ico

Path C:\Program Files\Internet Explorer\iexplore.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

lyncicon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe
Size 1.6MB
SHA256 a6ce8a1b666772ee0bf2280ff3792699b353126917998eaecee553400e3f81a5
MD5 1695a404d9cd6e4e2a09d8cbe2b958b0
SHA1 ee946a27be881b99323fb6c77e5f67be1ddc0c0d
SHA512 922dec2e2c9d4f2226908ca758c7335dd593445e717bd77d024b3b174fc9ecb15a132f6aac588c61392e403989e64caccfebfa751b688fa273a5cd7387a759f6
SSDEEP 12288:cceGlCTmZg+3PRjFyX5F0Y5XFiy1/wT3RfHYK2DOw5iQ6/PCtDGg+:NX97RjFyXQYRFtw7RfHL2D7VLB+
TLSH
T1AE753944AE48DC56DC0C1F34EE2072B0FA116C9FFE5E76062E517A2B21BF4E264656B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
Size 1.1MB
SHA256 d087137c0da05c3fc1734d2a8947f374af9cedbe7092128098bd45e2e9dece7d
MD5 f73501d39406c254a07b30dd2f7fbb38
SHA1 31f79e47e7458e40cf8dadfafba46c5ec23a52ee
SHA512 26ee045c5c3ae1e8c2ba137ff69f80fd513b9f046a417aeb461ef435b8cc6480355b19f9c1481337778e75dc52e0b2711a186f0b859bb6024ce11542f2d58ee1
SSDEEP 24576:EwemBmF/5RASQB48UerX1pLMZhXYfDtczAe:WmYxngFfz19ttcv
TLSH
T16635BE0972B84C7DCD5A89F99A91C3D175EA7823C792860B5E728D4C392728408FDB7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineScannerShell.exe.ico

Path C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe.ico
Size 3KB
SHA256 9e3f1f8e5166514df44b02a1e0bf7474708dafba161e263cff087af62ba89ae5
MD5 d8ef82bb84e2efe95de666f46d0c7ac6
SHA1 fcdd2f6ceacde21e1e38a687041138aa5bb0ef68
SHA512 61f7439ba615c3250701aeecb96ab8319f2d84ffa7e61076f6dbfce20ee3409d212e8d9deb274b145b7f0eeed2388681b929ba897bc85b4d3841f7003bc40afd
TLSH
T1C461FEC2D34610E8DA8268F34DB58DC487650CD540E4ED920EE6BCE39A745FDA93188F
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
Size 1.4MB
SHA256 1846fbc2e8af23d674802a287ef115c1d50f8a6f7e05daf34dc9f2e056b10204
MD5 80c074f9ca91905e382b90ccc899e993
SHA1 41c6d771f357d3c0ce81c32423212a279b3661ca
SHA512 47e2eb50221bee7fd2e118ba58c2422ae6618cc79cb4d354a1f9d0f81e9b8e864fa3f8ac41152dc216c8534103da2f7c3daee17f9cc65ca7b0e180a6a58e6bc8
SSDEEP 24576:VVrb8/42NqJ2LWNg+znBPJMysZgjS1hqgSC/izGfU2JGlbhlAZ4/:VNqJNRLWNHzDRjvQo0nGH1
TLSH
T17665BFF9A2079436D5B983729CDB53705C29E91A2703482FD6D8BC1D6EA84F027B7336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-7.0.16-win-x64.exe

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe
Size 1.4MB
SHA256 1f93288217a0b63ac21858502c298106110c40d4793ddcced26d122943689660
MD5 26fe77d09fc62ed955a64c827eaf93c1
SHA1 9e9161969cc3e8e19472de9a60bfe767c245261d
SHA512 30b1b6a72db20b4a2155119062360dcbcea1922b699ad5d84749e066a3d1951bbf918080ba27c61d57b825c8f2893565e16a6610d157927d382a9dd447f4c688
SSDEEP 24576:5jNT1woLvov/CIxBUfs1SYMIwzV5JHdRe5mWpI2jFM5sFzfTpi71R8dZd:5hpbvov/PUfWSYMIi5JHdRe5BjBbTpiK
TLSH
T17465CF26A451BC73D7BE0572961483EC3F79560B03A24216EAD4B81E2EEFC441AF3677
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
Size 27.4MB
SHA256 3375864a0e020627f4b307fcb4f51bb9e388b5e68a6bb8e4cf0a9c644f3b3311
MD5 926d69bc7034f548e2fd7165d38dccae
SHA1 86a7324f4d4539344004b2d0ad7d790abb9f09c8
SHA512 4e957aa3a8c54ba46108d680435effbf29fadd4d2a3c534ce53bf9bb224deddf155c81d0f17c4d6636631c6374f12eb084c530525a0d7751b60d0ffc9634cfca
SSDEEP 393216:Kw5ZbDO6RGmb8hFZtxwbTNXp3YCkxJoPMAvqkWgoj6RVFK+q3HvUUw0vXL:KWO1c877xqpyovvVWJ6VFK+q3cSvXL
TLSH
T1565722927BE89035F4B782307A78527D457BBC215B3182CF3296F61D1A709C19A7AB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_8f00a2bbd9436e8f1d91d4182e33861d_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
Size 300KB
SHA256 33d63a2017e2d8e00cf5122c642c7fda409807705eda849a790d5d8148b12a9a
MD5 b6f4641af37ddbd68e82c16007a0ae52
SHA1 a4888b25be3f4ab03ff4a97e23a40bce81cbceaf
SHA512 ec9d2b77a6cdedf0e5ae66ee164532cf237ecee58f4cd6ad4ede74e9b9bd8207151dc245f3ab3952a2fa3ef7d110723eacbb38264f8d73911784df22c7531c74
SSDEEP 6144:5habloKMimZI46P5Bzb854fgJs3uVAOs5qiwckGIk0ggwJhi/rQx+D8:al5MiU50jb854fgfK5qiw8Ik0ggwJhik
TLSH
T19264AE0276E18072E5721A325978BA7259FDBD300921CAAF23D45E1DEF31781D63AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2004-0-0x0000000000400000-0x00000000004EB000-memory.dmp

Download

memory/2004-783-0x0000000000400000-0x00000000004EB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads