0addc830d75d3eba7fb2a808262a1e7f0ce02e0d32de5c88f993dd5820c939db

Analysis

max time kernel
149s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 00:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 1.1MB
Sample260816-avqsrsan4x
SHA256 0addc830d75d3eba7fb2a808262a1e7f0ce02e0d32de5c88f993dd5820c939db
MD5 596125abba28421a90f549cc53a07fdb
SHA1 2a4a65d459495086195db5f8313f24c89811bc5e
SHA512 1affb9f600bc9ad46931f156fd53ec73e5c19ae5911f83a707685c23cf7c4ff5da6a7403a5d81e828d6597a155021424b1a521fe864cd78dac2ab55ea28b4ae0
SSDEEP 24576:F2Rg79bR0OnrDby8xievGcVRwUl5MiUOdfgiAiwyx3:ARgX9rHywF+sevAfgiAiwS3
TLSH
T1BB359D1DFACF80F2D22A3933186987F7B5E66B292611450B5FF4661EEE3024EB435274
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4812	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.ico	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCXB286.tmp	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX807E.tmp	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX91B4.tmp	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe.ico	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX53B2.tmp	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.ico	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Windows Media Player\wmplayer.exe.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.ico	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\RCX938D.tmp	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe.ico	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe.ico	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\RCX704E.tmp	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe.ico	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe.ico	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\RCXD132.tmp	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX5B3C.tmp	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.ico	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\RCX94C8.tmp	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe.ico	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.ico	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.ico	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.ico	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.ico	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX8FAB.tmp	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCXB430.tmp	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe.exe	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2296	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
2296	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 4812	2296	2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 912KB
SHA256 7f423bc47aedeb01097c034f61680d5ebda145fa4267e5dbb3bb26ade254a3c6
MD5 8d90ce8231344bec315861e7b7625710
SHA1 c553e1c64ef5bfab91644e8d6bba8bc2364aae17
SHA512 92426644ccafa9ec43adb69ecd7a5207f860e15eb2fc2bacf8c973678e53cafd45630b07d1836ab4837398b02a163ab71f45fad0e126a49df1dfb76fa58e8d45
SSDEEP 12288:DYVg/DOttlxZ2Y+8d264pGVgVPfDtclFw5is88IqlwWTzp71chk6YmIjE72:DYK/glxZ2Md2fpmknGg788eh772
TLSH
T15C158C473A0AC47AF40856F074B9F3F5D7E2AE266DC2081AF6193A3979F0D46B539234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.5MB
SHA256 970b8a033685a1fd3a1e03155c622504f4ccbd9d2e2aa800b19534dd90b5746c
MD5 e29697c667b9354bf4a32b60d73dfafa
SHA1 9a4f9c2c7386cf4288971ad4c062133ed7038f1d
SHA512 3d7ccf536fa09bf7a05a54710de1e963e64279ffb5fac4b2278324e7170bdd23888f716f51105cbb6278470218019bef259722ec245f4a3f2d56896a10f76a34
SSDEEP 196608:qbGZW+0wpog1P9fIlOuz6IgF+I3m2MXP6HG8Qzb:qbGZW+0wpognqO86IgF+qbM/6HG8QH
TLSH
T189667C22B5E08025E5F732756D2C673959327FA29F3145CB86907C942FB43E3293A36B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.3MB
SHA256 9dabd1295246bc85db2baa500ebb65cb27e7a103cb49f7c531e094216e8a8120
MD5 715e95d5dfd518cfbb4221b3cc2a28f7
SHA1 51bf4fe97f06965b353febb1c43fd0b978913bd4
SHA512 43da776b1a36ff2106e99b7e5c11846a887085dd049fcc4e62d230b2fadc4776480a9d73647bcfb02be6903cb7653c319a26b54d1756218ff914f5e59e6fe171
SSDEEP 24576:j6GkXdP6MjjxnELxQOUJtUp90v1XFf3ng7d9+1UXJwhXCTi2Qlkkkkkkkl0T3gA9:j6zsQOitU/03nmdXa5o5QPQ+
TLSH
T12AB59D07F6C982E5D05DC278CE2A477496223C915F545ADF02A47EB92E7BAE00E393F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.1MB
SHA256 48a3a6b300bc460716118ab5ea79c4b643fd36cc38377c494ee946f658614675
MD5 8cd190ff157e17a78256e8ebe5fecd12
SHA1 dc3e0c295af091b0762c303da1df473455bf1170
SHA512 f1e978aa4a617875e8bdb637a3fe0324857100228ab4eb447654d87f9ebe6e3bc16cc6948a11856e7e0a24cbbeb9e9b384c0263540314f0d7b97e07719385d7c
SSDEEP 49152:QJsqg489Bujcjru0WjiMgCv1jn1ChuADSi:esz48WjoWjN1jo
TLSH
T1D5A59D03F29AE1D4E05DEFB6CB42C566E97A7C020B2455DF0AD872092E77AD45F39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.3MB
SHA256 cf74c8b7c27aeac613bca9727f27b4ae4fb253da37a9d57508c1a284e5977674
MD5 16b3952e8016c2bef2959c984e73e5ea
SHA1 30247f13362e40c68817d1ed783778b6a64a7e7a
SHA512 c5b754bf8a4ef82e91a8de514ad61702cf2857cf9708f4823eeb59a557ec3eddcac9962bd967b6314f06af6559e27dbe876d1eb096bb45a583dc1af93f9f4d06
SSDEEP 24576:ZgOkFDPjxZpRUKDw7k+6R0A786n9kAJ9tA3L:ZgOKjjL5DI7FA7T9t2
TLSH
T1AC55C0457798CEA5F0AE83324C42C1A7ECB97CB94BB6448F1695732E1EB25D20F357A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.2MB
SHA256 9f3db23056215e494d67016990fb73156f5eb2499261a70d831dd565b9ae4b43
MD5 e0b0f434132018e4b0360d22d24edd7d
SHA1 e97eaee695402d8cb857683355a0af01b96aa71b
SHA512 0556ffd3e94ad340a442d5981e91b42a4948bf7bea6d1fa0260bd5e213389dc3849193f36b743e1e2994e4e787ffca334e705a1ae89b0fb92f09b4ce2ae977b4
SSDEEP 49152:nDa1Z6r5hXSUhw0IeRL1hDfehjvHHKTdfxINPEt99G2Bo7EukU1a:uZ6r5hXS+TLyjvnORmE
TLSH
T17AB59D53B6DD80E9D0D9C8B0C6379232D9A2BC460FB466DF1B40B20A2E77BD45B79721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.6MB
SHA256 262bfe20efae0597e503268ae10770276f1d5ca9497e79424214161a52d0ed63
MD5 fba3a1d14fa3860caef424d6039fa989
SHA1 e69e554ec581f6bb8288102a428c262086c51b61
SHA512 9c37df02cb04f8c4a3bf63825a3047f78c357b4ff522fe1012c528ccb407623c2a36909175c082cd70564abd7cfe6946065163c45ff5bbdcabea96c68bcfd775
SSDEEP 49152:BwLHss6ZGu6qG13O7Q7gLYduZrSdHBAVfb:BQss6R6YjwA1b
TLSH
T114C59D07F68990F5D04EC1B8CA77C7A9D7717C545F206BEF0284BA142EBAAD44B393A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.2MB
SHA256 b035b4da34ddcfafd42544ddcb3b42eb91cc43917f98547f49fa58ef643f5093
MD5 63fd9a4ceda0f0d0703ef843f983c053
SHA1 0693ab95467364546964c2748efcd8865e8869e0
SHA512 21ca63497ad91039c5f4acc514c0d7fb6db1434c6ac2583f6981d6af70edc9884df2552e41e525930390f9106941d5899ad1e61c14f3c0130d6a4867f7f84408
SSDEEP 49152:D/KEVhwXLORY2fF8FhmS86IUJWQn+6h27d6:D/fAMbOjjsts
TLSH
T1FDB59D03B29948E4D0ADD0B4C75285AAEAB17C510FA466DF2740B75D2E77FD42B3BB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeComRegisterShellARM64.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe
Size 1010KB
SHA256 e40dc8a5dc2fb65e8fc4b7af9d51457d52ea7feec86c0895da1821db64503f68
MD5 8df3b55003723b4c737ea579d3b45c8d
SHA1 c4d6be871c05a0585b96d61e89033934ae8d7701
SHA512 bca596299e4603d6dbd78b9af730bae785e91fab46a2e2b0c95d99f3eb94adeee3501a65d92581da2d9201a01205cc58521fd479cbe90ef49eb5b27802ea0285
SSDEEP 12288:30cOs0pEj0zlUDks6nM6YwImQSNv8hbCba+5PSyfQcw5iaJQGHg:30vM0c6M6YwImNNv8hbYf5PSlZNQug
TLSH
T10A259E25B0F57491D06A84F055F72567DE2FAC39B81A8F43D661A2CF6C318C4ECA3A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.8MB
SHA256 6885e376792790858904d72459a83d01f4759d09b38134a13f4ce31bf041f785
MD5 1059205d75edd00d9f3e3f182cb10d97
SHA1 8b5d85c000fd11454e3c1b29cba7fb64c34fe702
SHA512 81107a08fb3a3a07ce37be2c3cef412d82650e887e15950fcc15257269e714f3365b91d7d566086ba3c69977812a8c29798257881b153d3143c22eaae1d3b288
SSDEEP 49152:CP9n1qG//03+yJYzno7fvTqJdbPrCx9pG7:CP91zn03+yn7fv0dbWG
TLSH
T1CF95AF0B769840E5C019DD34AB6142BAEAF27CD10F3455EF0AA0B34B2E769D85F79363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.2MB
SHA256 20c8127ed06f2d478767f4b64443cdb6ac5fae06a89b4cf31f0840886405e52b
MD5 bf944fc4009d357c01f481914fea0473
SHA1 a746c33b6ec3e8c21103df20dfec8fa16d17e78d
SHA512 607bf3f09ad4bd53f80bf11661558b8205bb7f82d020c73375e66136cc8ffda9e1b01651813c8fa3dc2fe13f332605640d71d1a1d34d6772037baa4e6ea5dc21
SSDEEP 49152:WAv48fW1QVvG6DvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:Wa48fW14vBI4Ds9Ol
TLSH
T1F0B5BE03B3A940E8C099C174DB56AD71D9A67C514B24B7DF0648BA581E37BEB1B3E332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.2MB
SHA256 42e772961ce67c9f950fe66e2ef4e0742b5a5c17f88a8816a6f417ece1185895
MD5 500367cfbd41f69eacb0d1f418353ab6
SHA1 50787a443d972641385bb33eed02232ced725eb9
SHA512 bf2bb8781765a918953cf660adb084d02dfc0373c86a9971daa4a81744d70b3035677f056b5b01a627f42ec8af4bc5baa44f050217e5fca0882aaba6f8a21b2f
SSDEEP 49152:0S3eJAAH3QCkA6Up46N3AAjZKALAAEAA+FE6AbpA7iLqHCAyAvGQW2JAjAY3333o:0kkqko/Yhy8OnZy
TLSH
T174166A03A29910D9D059C478CF6A8222EB62BC8847F566EF3790B6D53E73ED47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.2MB
SHA256 5960fa6658176ea5953fcd388e3223af13047d5f3b3d83c9f082cc95d438eb92
MD5 3d5832e1ea61b29604cc2b0bd78162db
SHA1 3b1329c64e2a31ca5a6d9663cdd584c4f886cc92
SHA512 b289b26f423df78ac7862da491683f99c0c329b742dc322bc3ba3943307e7c999c754ad91f35cd5a0433245e4022ac41070214b948abcefa0d2da0646f299b50
SSDEEP 49152:eUCSI6j6uAOAp4Y2fF8FhmS86IUJWQn+6h27d6:pCSd6sbOjjsts
TLSH
T139B59D07B68842DCD09BD47AC666C53ADAF1FC052B25B2DF9A40B71A1E37BD44B39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

7z.exe.exe

Path C:\Program Files\7-Zip\7z.exe.exe
Size 824KB
SHA256 250885d0a7ca116f2351c51f37fc225640af27778520599dc99a91a402211988
MD5 36d9219d4a9dc6c14257bc88bc80711c
SHA1 0e6aafd40596755fbefd367fafcd001c3c84f454
SHA512 922b7a746e4d92427df3ba1b066576c2f078f4ffdb55139ecb87d068df70ab9a8ec1b2d981b5cba7e9939622ece6a30b445d2001de76bab2fe4e6db9f3bef574
SSDEEP 12288:9n2Rsl79bEK0GFpnrAZCbyJSNnXievGrw5i8RSzR:F2Rg79bR0OnrDby8xievGcVRw
TLSH
T1E6058C5CFACF80D1D22A7933146A83F7B5D26B2A7742050B6EF0A62EEE7415E7435138
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 907KB
SHA256 08afeadd6d863e3c27a31298571900d00098ead69e138467dfe44057c22846d1
MD5 a437eb298bf21c52b27f315b81a8b978
SHA1 270c676a2acd3aedb7f0362a489655ef4fecef48
SHA512 30bde729ababaa29c65ab9709a885a5735cb078a8991f16695da356c410c451dfd476d6a0177e9a6226a2388ad7f5ab5106c3770d24250ecd1d5b76867b6d1e5
SSDEEP 12288:OfI9kRTUEkCKc4f2pyPz1xjvK3ySJVR3WQRPhdLJltMMGZToz/KSw5iD8PpUqF:OfIHClGvhsWQRpdr+Zk/K//hUqF
TLSH
T1F4158DC5F4B18219CA9523F07F5EC3DDA5295E919C153B2B6D58BB3B7CB828DA00293C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.3MB
SHA256 7f7968ee0442e9149d10334d6d8b9ef674c08d32fb94aaaad27481c8485ae27f
MD5 8a5078ea8ff3bb818d39f4c1a15cae4e
SHA1 650a46e121725a04d8d753f22555679374bc8e86
SHA512 7724bcb9a84bf4c4d0794ae8e0171b92dfb9d47476185e81857d0800fb11b4aebe5b59f465cc6582ab4936df4f01cad0d069fbeef0328cd1139af6c04875df3b
SSDEEP 12288:SHl6uKl2ti1DTw8kQMeMz4TqWhdfU4q3AysZu75yqMUGw5iQacjE85bM3npxYfjg:SHl6hhtcujxL/eNjG3npi63iC
TLSH
T10C557C05B7F98061F9BAAB319B7682B1497A7C739D31C02F23F42A2D59747809935B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Size 1.2MB
SHA256 4a1d54cec7dc98f83504d555e39bdfb5791b2e4e59ddb2e78f4b4f650d0489f8
MD5 8556974fbecc7a629685c3c8b0911d45
SHA1 983e2844bfe755b5f53a4a2c369956bc073534ac
SHA512 c678c340b1290885ce9c4b49aa1d493ee5d32dd47764fc39be9ffdabc5837ae151b8d2b53855e0df6861f010c4292f7bd864232271e5e792a28d25a4e40d6945
SSDEEP 24576:7DJcUURThts2n7mQn2b5rbMYenGJiKEbXWtpOLl8:7DJcUURThts2h298PnRWt4G
TLSH
T10655C027B5B1C025D1A10573A9558171BE7958C8FF20F0E757AC7A1E3B78008DABB3BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.2MB
SHA256 3f17123b6aa0d818042d1ee8418806c2d611d3c91525e2b65c5a3d5a3f5ecf5c
MD5 db404cca79a4706bea9f73ff637c9c24
SHA1 5d4d037411a1a2fb47ce288f1648e5ee7726f138
SHA512 58e39f12a517c026ce836c37028a2057a12f5c1625be250e6759d818d0733e517464b1d4c95c5f356f2c1139e86793290e13bb9c5cd08db167ab6a21bde96b68
SSDEEP 24576:FnGG1LydDevqax9QLSbF6UwIGCEBMYenGJiKEbXWtfOkUy:FVydDevqK9QL0F6ROJPnRWtGkf
TLSH
T11455AE29725BA132C02D00F6586593706EBEF8576B10246FC690EE1B39ED471BD7E3B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-6.0.27-win-x64.exe

Path C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
Size 1.4MB
SHA256 8d9da0bad425bafa324b39454a7188b2f7ba5bbc963ad4832fd7117a2275cb07
MD5 e87717cab03c00b83ff707bce41a48f7
SHA1 34440cd71e8b886849343579065ceabcf26ebe93
SHA512 825ac2b61ea4b09eda7ed2b881dab0d978a0b260cd4689724ff512f7302de5ae69bbc26169740cb80966c590ac9a02d69811a45e1997447a03d725a176144a15
SSDEEP 24576:aYnBcp+BnnNi0T9+35mWpI2jFM5sFzfTpil15Z+M6qTX:aYn+p+Jgc+35BjBbTpi75Zr62
TLSH
T1DC65BF32B523C037E6A485B29962FD302D785B19E650C46BEFEDBA1E3970450D7B3272
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
Size 1.3MB
SHA256 42ef6fb3d135db9bd4d85238c1e8b7c8e64cc3129c1bc8b47a115034704cde76
MD5 0a24aea4351124bb1f04d101b3de035f
SHA1 3c7d69ee2f0e180141741da6239d5726395ee918
SHA512 ab4a578993421eae0871b917bad43fcb45344c6b8b6822c4660e00140fb2574012fe48e37fb281b8a533b1027aa4dcddf75fd23465ca0d7fd88167a242e6de0d
SSDEEP 24576:G1zLBY2BSX2xaaZSf7lWa+FV7tBOkUhMXcBwcy0G:GLrBHxaFG7HUasqci
TLSH
T1C5559C3662849437C1690432A481FE63BF7BAE346F1389079388BA7E796C051D77BF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-15_596125abba28421a90f549cc53a07fdb_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
Size 300KB
SHA256 392c6fc01b2866dbb631a11ebf9410cd1ecf91b4cb1e87425f0130d3d9eddc31
MD5 c6fe1e0fa0aa3a7eaafed34a327c6271
SHA1 31a9700a4c52baabcebe252a266e8c47fb9ecf2e
SHA512 99b7beea05b4c0c8f4892dc3ce6d2fe8c289f6236dd44bcc092e9a0f551bfe5da857ba15aaa96722cb046b85bb200a1df1758290b7d63d07a4e9860a90ef5ffa
SSDEEP 6144:5habloKMimZI46P5Bzb854fgJs3uVAOs5qiwckGIk0ggwJhi/rQx+D8:al5MiU50jb854fgfK5qiw8Ik0ggwJhik
TLSH
T1CA64AE0276E18072E97219325978BA7259FDBD300921CAAF23D45E1DEF31680D63AB77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2296-0-0x0000000000400000-0x00000000004F0000-memory.dmp

Download

memory/2296-912-0x0000000000400000-0x00000000004F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads