27a3104e35eb3240540de6066030a3162bacba0b6274f584f258158c7cbf631d

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
Size 2.3MB
Sample261001-sdphgsshrg
SHA256 27a3104e35eb3240540de6066030a3162bacba0b6274f584f258158c7cbf631d
MD5 49883b3f454c987fcf2532f53a349642
SHA1 f5d6b11e57db915fdc601081b12c266a2dd83cb7
SHA512 a9af285fbeecdf05f8e67b3a54b9cb894fc299ac7b91f98be229122008ef67f9b84dd9aedc4a4f4178259b789a0ed91d018a94e4de7aaef849b1cbb185433bbd
SSDEEP 49152:XhJLNY0xNCN3piEa3B/yvJJHBXNTn325kSiV3QpOmTiGIcNMzwjbVPTI/:Xh5i24ihyvJdn3JSiVgEK2cK4bVbI/
TLSH
T1E9B5010C65908F2AE07648305DA637F055AABF2EAEE5864F275CB82C1C7CBE5D431736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5060	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RCX6C7.tmp	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.ico	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Windows Mail\RCX1804.tmp	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe.ico	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCX3F54.tmp	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\RCX50BD.tmp	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\RCX8A0.tmp	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3AE3.tmp	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe.ico	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.ico	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.ico	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX14AC.tmp	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe.ico	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Windows Media Player\wmplayer.exe.ico	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Windows Media Player\wmpshare.exe.ico	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\wordpad.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXC99E.tmp	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXD73A.tmp	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.ico	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.ico	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCX4042.tmp	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCXF83F.tmp	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC0F9.tmp\msedgeupdate.dll	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.ico	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe.ico	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files\dotnet\dotnet.exe.ico	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC0F9.tmp\msedgeupdateres_en.dll	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC0F9.tmp\msedgeupdateres_en-GB.dll	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC0F9.tmp\msedgeupdateres_mr.dll	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUC0F9.tmp\msedgeupdateres_lo.dll	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe.exe	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1676	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
1676	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 5060	1676	2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe.exe
  C:\Users\Admin\AppData\Local\Temp/2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 800KB
SHA256 3ef9ed66b935cfd6a36bbfebae2ac1daf21b0f74f69907fb83db5ab32049dd6a
MD5 6845d086e7947dc46954333cafb18e77
SHA1 e31cd3286209e994749ba4b7b4d152b98fedd4a3
SHA512 1988742a7511aa2f3c19658c74bce97d09579712ccf45ad70752cb8778e1339f0f3c672b8a36e8a07cca416d56121a98982ebed59698283a2d52280b7b58caf1
SSDEEP 24576:81Z+TudFs5RB4BxELTdtjx9cpC5gvu4XvcCvi72:8ZMudIOBxE+CGvq72
TLSH
T10D05BF393042CCE5F267003488D512AA9662B7A26D738A1BE3D5E7CDDA70545FB122FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.4MB
SHA256 1b288bfeb02a145ebfca8eb6158b7cb662cb9fee88c08bb5ff1df13e524ec606
MD5 e80f397467042472020ff2513cb7d3e3
SHA1 4527fd8bafbe6fe3e4ac7ad9fcf46d719e04d287
SHA512 a114a92cdf2aa8d43c5e762794453f9c5b806f3c66003fe7faf5f52da6634799c89386d3c0821576d690f236650077b6da28e5f73773b94b52aacc30f72b2b6d
SSDEEP 196608:tSCH666+og1P9fIlOuz6IgF+I3m2MXP6HG8Qzb:tSChognqO86IgF+qbM/6HG8QH
TLSH
T137668C23F4E04035E9F732356D2D673959327BA29B3146CB86946C846FB47D3283A36B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieinstal.exe.ico

Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
Size 3KB
SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
MD5 f48ab39db9ca4956776a50b86a8e8c81
SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
TLSH
T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
MD5 SHA1 SHA512 TLSH

Submit Download

msedge.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
Size 3KB
SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
MD5 cc055af6d5fab0514052a985d406293d
SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
TLSH
T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
Size 2.2MB
SHA256 9fd09f2cc0c7cae9e7dc7fcd09ac205436258795f683a97f77a5fc9555e7fd80
MD5 d9fe5a8446915017e54139caa3349398
SHA1 095c08f11ff3ba08475939ffc3cf76073bc8b2dc
SHA512 8d173d3e644a9f1cfa26409d183c717eca025ab25310ea83b5f2688e4580aa2cc31e4af33cec910cf207c4fd14b83581b7ad41c5800935efe0eb0a11b9f52e78
SSDEEP 49152:GL/O60gNVkMgjhQCQOitU/03nmdXa5o5QPQ+:GL50g89/03mdX+PQ+
TLSH
T19DB5AD13F685C1E3D06DC978FA364B70D6B13C657F2555DB22A0BA192DF6AC04A38BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
Size 2.0MB
SHA256 2c9ec8ac643e7a882d9071c6316733564c88b2071b66af4d522f66d3e0eafb0d
MD5 01b6e698962ed40951ba58954ec844c2
SHA1 2ca839011257441fed224cd89fb43f6807b48794
SHA512 3a35aafab24aee59a6ab250a127431859544775e468d32bc1abb9ad172977e68bc00f0852e832d7f2ca607a0f43585ff8d1f30fd13f31c77b4fae08662a0c7d6
SSDEEP 49152:U3gQ1M3JDQhryx+ru0WjiMgCv1jn1ChuADSi:U33WIy6WjN1jo
TLSH
T1CDA59E16B2A983F6D06DDA7496468166DAF1BC410B70B6DF3FD872093E33AD44B39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 1.2MB
SHA256 bd8af1be28d2f416954e26e69dfd814e686b64fe412c0279df401cbdeb3ad103
MD5 44080ef6f05e79ce6bdebeb55cc0c32b
SHA1 44428ad24956b0c3e6ccf4356a893e8e9272cf86
SHA512 fc0b3ac1fbd895ea89299e15f31bc8eda3f73146933f287c605b33916b80fc6eb23a622547f3e20f802e11cd2aee56d05e84879bf97f87c164985b5843b0efd7
SSDEEP 12288:92HHht1yBWGYT+p/rbBYbBEmPKxmw5iJtA8S86nHrUA9HVlK8SQBJ9t4f15rL:Y/1yBVYT+p5AeRaS86n9kAJ9tA3L
TLSH
T1D445BE85B39486D6D07EB97489534B93E636784A0A71A1DB4BB0422EBE3EDD00F7D334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
Size 2.1MB
SHA256 f0c93a919135a668184ef6650fa4326593f395c486234c10ac88d8df470a185e
MD5 2c9a52a8b8f725fcf4b9b7afaea549c0
SHA1 1aa849b5228ca8bc2de4fb991225e33f03ff6050
SHA512 b00285d7f8c667195794a50b3e0a37ba27e4da96b25e0480419a8fefcc2fac3c60638bba1cbb76620e7329827c1f6b38cad9a4b5f921da53eaa462e0f808b01d
SSDEEP 49152:BXRy4X/kOmZfehjvHHKTdfxINPEt99G2Bo7EukU1a:BJXiyjvnORmE
TLSH
T156A59D47F29841E9C069C8B4C6495977D9B1FC400B256EEF0A60B2195F7BBE42B3DF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 2.5MB
SHA256 38297e1457c369e226232865204975be2e22cc920cf83e4c9e7903b524bd2998
MD5 ebf0c5f69f118eca28bbf4f497c97f5b
SHA1 f4e9693784c876f01436a8e689f53a372c4cb883
SHA512 7af63372cea981681bd162c8c3e19506450363c1179f0fd746fd7ae4e92bd31953706b660858c73e37fdf964bfe98917ca9a71427506112e87de744e10407ed2
SSDEEP 49152:vHH03L3rGZGu6qG13O7Q7gLYduZrSdHBAVfb:vHU376R6YjwA1b
TLSH
T151C5AE07F68582BAD05ED2F8CB66872596A17C5D4F6156DF0384BA5C3EB3AD04B3C3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
Size 2.1MB
SHA256 4caf6da744f663d8377f99e753cf1326ff8d8585cbebea95657a546b9522f96b
MD5 e827f21cafe6e88b0e11fa39e763b457
SHA1 45db267ba7855d6857f5aadbb8a6a2b83e02131d
SHA512 2452872f21b1b1e87fd17c950b1e812a943aa17fb8bebd95a21cc5259cd3a0e1074bead7d82c85952d6253bedbe8153273b1623f57629bb85383d798b3c76508
SSDEEP 49152:vNhHQv7ZCY2fF8FhmS86IUJWQn+6h27d6:vNqTZCbOjjsts
TLSH
T186A59C07B6D840E8C06DC075C346856AEAA37C454B2A6ADF0F50B65A2F77FD41F3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdate.exe.ico

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
Size 3KB
SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
TLSH
T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
Size 814KB
SHA256 0c1271fd02764378ab1f9c7d89329c860d8693e5b0e5748f294a0cb2d2e6b869
MD5 1e3cb78217ea6e97d894e149e627c891
SHA1 7701491b1c0ade3727945c8c647feb8cc75dfeb7
SHA512 f2c8651d6165b69482e00d5cc583f9cf32097bb087a4f18b6802a228a500bb18d6b4154c75be5aca7e173347fef613b65dd6bc09ad172afd13509b1cc465bc63
SSDEEP 24576:tuwcZ6MWFLW8qAbgDavuLCpl7u4dbBPzBAU:nq8WDaviely4BBPVAU
TLSH
T1C405BF093C83B466D32C9FBFDD90DDE7369FF86E8A11082B964067E918714C05B6B6B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 1.7MB
SHA256 1b0be1d29f14ac842d26c2f0049bf44e35a063ad4f40b4ac771569461687bf70
MD5 a1de0699357306d02f33d8b93eba926f
SHA1 46ea2cb6c2e03508e80e5fb6831d09d5118a2367
SHA512 f604659c24015969030cad2ec2e3f0d0328fe6fed92301e7161fd9dea3a3fc51a0542f8fa9dc145f2e50e37f958e64525d6f778cd60873fb32fd46584280cd59
SSDEEP 24576:HMX59lkujBs054terjYmWHHo7fvqcXFudDJdWQCkvjZQqg+lIVprS7:g5Lk2fvjYzno7fvTqJdbPrCx9pG7
TLSH
T12185AE06B3A840E9D068FEB4C65A81F5EDA2BC952F7452CF0692B2491F77DD41F3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe.ico

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
Size 3KB
SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
MD5 70f7eb6f0e42805134583ac203c2dfd9
SHA1 fc513300d133a9b8a45da81a72a10b937e909190
SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
TLSH
T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.1MB
SHA256 8b309e9d6db2f1bf29aeda5c1f0d5c3ac1695da3643de6dc0c17e38552a00bce
MD5 3c20d441b2a38ee6324fd197467747b0
SHA1 295b9ecaefe66b85684a15bfdfa66c5a3bccdfde
SHA512 68cc7157d98a537e7bfcfa48dc4e37ce249737ebd875169c77207d9e480eb135945abae8daf9c5a057eeba74fc50702529f932b540206f25e1482b43c71a347d
SSDEEP 49152:42OMcDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBB:II4Ds9Ol
TLSH
T1D9A5AE07B2A442E9D05DD174C6964D31EAB27C120B2E6EDF0750769A2E3BFF51B3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
Size 4.1MB
SHA256 9d9ac6092904debdd7cb1dedb45735024d464bf9b0cb6f363093a245740df9ad
MD5 de96b39aaf01ab2e57404b0ed764088c
SHA1 c837649c65986e09bc810975f99f823a0b6e9c38
SHA512 478a062a76847840c290b59cdfceb16330996234b33ae6778694c54d0b9eb133e462568b17162bc7461042b0926a70136277243815a3b54e86fa2d7461a5e84c
SSDEEP 49152:YpGkPO5SntguZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrZ:YpGkO5Bo/Yhy8OnZy
TLSH
T1CD165A03B29940D5D059E178CF468232EBA27C8D47F562EF3650B6DA2A77ED07B39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 2.1MB
SHA256 329f98f70ded7f4d29ad980c7ce0e98f48848244be1f9f75de0d00cfde78db0c
MD5 5aab523c4145635e837f8dfa58223ee1
SHA1 483b74038f204103174af9c7262dfd2739c45edd
SHA512 f27bebf095fe78ab1113627e4ab769b2b1912d46ce33af17f5ff70cae8b54cd8526865f6df0bfa496d99f3bb70abe8ba13f32ea18e1b00b899f9656eaa937fca
SSDEEP 24576:nWHMdD/n7g8DUy492PZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:IMFvTDUbY2fF8FhmS86IUJWQn+6h27d6
TLSH
T1C2A58C13AAC940F6E019C1F4CA46C5A9E9B27C050B65A5EF4750B3493F77AD8DB3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe.ico

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
Size 3KB
SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
MD5 0becb6bcbe9400e6d9441ceef104e743
SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
TLSH
T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
MD5 SHA1 SHA512 TLSH

Submit Download

RCXC5AC.tmp

Path C:\Program Files\7-Zip\RCXC5AC.tmp
Size 712KB
SHA256 c6f342bf93aae66276b91ba44735c0889f13ec21fe375fec78494d9d6968cde3
MD5 c7897e03d96931522a5e2ba3282f6bc5
SHA1 fd3b1d8f2d03870231f8a38837695debdb18e2f0
SHA512 2e3d708ed78472ce93aa8bf2460d5dd77fc0cf07384f3a33c03185667808fbc75d9c36165b7778954b5c7fdabcb7ccaa2043f6616f1aa5aaec11129fab94d3fb
SSDEEP 12288:JlWwDtQO+SNYjAb2UK7b+9SKNp6qJGv2gPtucU0w5iD8a8:X/pJLNYjABKn+9SKNbOtvco
TLSH
T109F49E0C6490CF1AD4384C341D6B37F0A29A5B1EBDE64A1E6B6CF86D1CBCBA9D431635
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.ico
Size 3KB
SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
MD5 de1dbafd46ca8d953c93a1c89766a8c2
SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
TLSH
T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
MD5 SHA1 SHA512 TLSH

Submit Download

OfficeClickToRun.exe.ico

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
Size 3KB
SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
MD5 eeb23b93433af30f3061c261b8368401
SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
TLSH
T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
MD5 SHA1 SHA512 TLSH

Submit Download

javaws.exe.ico

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
Size 3KB
SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
MD5 13fb0b721f1a5288bba88efe12d3c4c2
SHA1 08899424be48b76e1189abac3b067cd19398282d
SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
TLSH
T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
MD5 SHA1 SHA512 TLSH

Submit Download

XLICONS.EXE.ico

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
Size 3KB
SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
MD5 fdb893a42e2519f60a9a943e687de76a
SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
TLSH
T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
MD5 SHA1 SHA512 TLSH

Submit Download

dbcicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
Size 795KB
SHA256 b5f82b0af999a7b3f5e0dbb62665922fac9b7b4627e8931412ade80d2e52129f
MD5 3a253832cbbd27314cc43272beede5d9
SHA1 9d9fa16419926f724ca03bcbb4ced53913b47e21
SHA512 f65a4da5542e16134f8a56aee40f3980d9140e57243be8910e69d306c0192491b8a712ec1079af099674340f75936973a6c54151c3f7d7667a460a2b9c1a0bca
SSDEEP 12288:UWk8LcUYj8IyjlDvjgfmuQ3Qu7B0mjjufUDzbCdSw5izBF:Jk8Lc38BjZAmuUF0XUrI/oBF
TLSH
T10A059D176781CB56D5771970CD495260503BEE428A8B10BBA170FB8ED8FFA21FF41AE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
Size 3KB
SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
MD5 1e135e5bf5dbc0a82efa354c532e9c26
SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
TLSH
T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
MD5 SHA1 SHA512 TLSH

Submit Download

ohub32.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
Size 3KB
SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
MD5 c8d18488a47a8054af9be67ebb94b6a2
SHA1 d231e824dd885833a1d6875741745994fc08ffa5
SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
TLSH
T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
MD5 SHA1 SHA512 TLSH

Submit Download

pptico.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
Size 3KB
SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
MD5 cdcde2807eee3a72d0b027bb11969739
SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
TLSH
T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
MD5 SHA1 SHA512 TLSH

Submit Download

sscicons.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
Size 3KB
SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
MD5 f142fd1b4cf10595f4565171b56388cb
SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
TLSH
T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
MD5 SHA1 SHA512 TLSH

Submit Download

wordicon.exe.ico

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
Size 3KB
SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
MD5 bc5b17be640393be725d1c6bf384febb
SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
TLSH
T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc.exe.ico

Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
Size 3KB
SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
MD5 0c328d41f4955cb0f6d408c63512c280
SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
TLSH
T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
MD5 SHA1 SHA512 TLSH

Submit Download

wmplayer.exe.ico

Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
Size 3KB
SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
MD5 44102aaaf107a6544eef73219f2c5f06
SHA1 c260d347155704cb817de08b8e72468897c446b6
SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
TLSH
T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x86.exe.ico

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
Size 3KB
SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
MD5 5cc1166b9cd6f8310369f631daf2f737
SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
TLSH
T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.3MB
SHA256 c10770125eaaa057afef2fab248123079b3c67f5ac587ced33b1297f67852f41
MD5 134b4cc6140c31592304cf8bf4d9f758
SHA1 8a672d0422444c8673199756f2bc1184d6a7b8a9
SHA512 6c6bd7bd4214676e43553325ee94057aaac718bad1c70a86a41bff903e6df5ab918ed2234fb17d0ba57254c517a86126bce102131a025d51ecb5b997cc44f6f2
SSDEEP 24576:sfi4sa5mDsTNvi0nALp+QKgGUqguseA6qm39PZfePv3r7fm6t+jqp+3l+zCM0D:iszaNv36RKAQHvqgZ2HbbZt+jqpQ0CMO
TLSH
T11755BF7178814066FABD0537ACC399701AA59A201612DCBFB7D0AD1D3DBC8D72B7B236
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
Size 1.3MB
SHA256 3f1f19963271271814e843738a3d3d00838f7a1ef46cfaaa6c887fd279856860
MD5 b705a7b8c4fe4dabeac8db511f3971ad
SHA1 d957cd42ea52c53c22bb438c66511d8f60429201
SHA512 b45fa57f9ef65747f50f9a796467182bf9db8cbb78395209ad88c7f553ab528612aaafdf09744e5c6f7461bc5b3a3ce950cca6c671c2d6feba4f1e104ea9fa00
SSDEEP 24576:IWN3fwxhCCxD6EMJEPbryEOSMysZgjS1hqgSC/izJfojymk4HM5yJ:IWNvCvByURjvQotoy4F
TLSH
T1EE55AF38A749D3AAE2F40633EF5CA164296BD81E1750489FF6D4A4AC7B740805FB3367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Size 1.1MB
SHA256 7cb203e86bbe49f347fcbc5aad94a066da8d5861ae3acbd68468ce3118f0732e
MD5 cfdf9033d355c4684a41177627dbe162
SHA1 b1f0dcb029c6279608f83dc6546d62d65aa5b5a2
SHA512 6542d05f4b5c247ee6e96bad014b4d5d9a36bb9c156a99ce1e9de813d78f70b5ab17dca9530d5d6a174a3bef85ffd998639d0ae0a3c5184aa2330c3a1b7aa9ca
SSDEEP 24576:d8PWAi6pU8aoGzOr0/LnY09mMYenGJiKEbXWtfOkUy:YHpU4GCr0/LYIPnRWtGkf
TLSH
T1D845BF37B5F88C62D5A25732E241CDA0BE38BD103ED1445B13686E5F2D7488279BB2F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe.ico

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
Size 3KB
SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
MD5 ea27d80794552048d73d1fdadac459d3
SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
TLSH
T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Size 3.0MB
SHA256 f105f411c61c9904c279aa48584f1418d7a9880b7dd5aa012f03ceea0b8811ed
MD5 7ca601f8033a5ae9a904c0da19530bf9
SHA1 3f0bceb6f479e2b5084648f980598b6ccbf7d1f8
SHA512 47da980ce487482b2a3bafc6ae00d881138d4c4534242ab0becac045044800425f0fc343eb51055cfbc2e0631e287583e6d3eae5cab2510dc0d66ec7e666e963
SSDEEP 49152:CN5q2vaEVGt8NVAjXR6t2jgZ8tzPFASjYhMleFLyJwXP9L8vzbtu14BCNbTc7FBV:u3tnAjUt2jc8tzhYhMMFW8LMprG2
TLSH
T17FE5CF217781E032D57301B18BFDA7FA9578B9316B3281CBA3C5175D6A708C2AA36773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 a0d4d8658c4866a34776e4cf4448fa1ca8758f73e959b062828512e81f7695c5
MD5 28061bbeed86508f3c6d7bc12a2372f4
SHA1 9cad7d8acb642fc476c1627fecd0fc75beca1c7a
SHA512 06db36c12e869ee34b9fd880edb4d05606788ffe414f19d461bafae6b5577c4b147a2152082b0843d8df4f1f8cde02afcb80eaad0585838b32ee95c8071de75b
SSDEEP 192:CCUyP/XOo5mbl6KTkRSIvU23Dw39MTt737Hxv6FxQyJa8FFGOud+:jP/X+l6IeQ2s3ylLoHQya8FFx0+
TLSH
T19343C496B844DA05DA095D369FEBD6EC7331BD26CE9B421335C1BB3F9AB70C00A19285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_49883b3f454c987fcf2532f53a349642_amadey_elex_hellokitty_luca-stealer_njrat.exe.exe
Size 1.6MB
SHA256 343347daa9ec10621b07f8d98ba54c983bafd388ddbc03d64b27ee658f51c9b7
MD5 9f4cb994e47c36207dbf018d664a162a
SHA1 ebb1c73c5a0c0bd9f70d7db1c05c91890243b655
SHA512 15bceca09ae889862fe2fafe2307b6a43e1d0fd74488d9654ecb685d4404f01f45e6f6a84c562dbb458e690c55978bb52425c71b5ded2138433be29165f3c349
SSDEEP 49152:0iEa3B/yvJJHBXNTn325kSiV3QpOmTiGIcNMzwjbVPTI:0ihyvJdn3JSiVgEK2cK4bVbI
TLSH
T10475122076D14071F2F32E30A5F09AB10E7ABD710B7584DF23855E5D1E34AE1E639BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1676-0-0x0000000000400000-0x00000000004D4000-memory.dmp

Download

memory/1676-969-0x0000000000400000-0x00000000004D4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads