Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/07/2026, 17:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe
- Size 1.2MB
- Sample260706-wh6jcaew7q
- SHA256 f0d9a12a0cdc360c8b4e676d3fc2436e2d72f50781319e8d602bae1a36bfde91
- MD5 92e36b0c0fa7c5e667d72a599ff9d629
- SHA1 82fb84567039ef532d212fb9938b6ddcee6fbec0
- SHA512 1d9f3a57820dea7e9166eafe1d0c8ba42d55459a154a544b7403f4d987b49de9ed45fd5937dc878e9b1516ec1e3062faa4537099fd263038604defc3da0894c7
- SSDEEP 24576:iuJ2a08VX5a+RBu8Grbj1koIvaBOkUhMXcBwc04nA:CMX0svKNawUasqc
- TLSH T1BD45BE31BD718073CDAC0A72E8498334BE79A81CAF058517D365FB1D2D66852E2FB663
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4860 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe.exe 2988 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe.exe - Loads dropped DLL 1 IoCs
pid Process 2988 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RCX4B39.tmp 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX21A2.tmp 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX335B.tmp 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\7-Zip\Uninstall.exe.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX27FB.tmp 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX339A.tmp 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4718.tmp 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Windows Media Player\wmpshare.exe.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX3033.tmp 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX66F9.tmp 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\7-Zip\Uninstall.exe.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX2466.tmp 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX2AA3.tmp 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCX9577.tmp 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX3150.tmp 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe.ico 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\RCX6922.tmp 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2100 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe 2100 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2100 wrote to memory of 4860 2100 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe 85 PID 4860 wrote to memory of 2988 4860 2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe.exeC:\Users\Admin\AppData\Local\Temp/2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe.exe" -burn.unelevated BurnPipe.{86D1FC02-FB55-479B-B4E9-20FAA5ED699A} {F201BD5D-55FE-4D45-B82F-D28E76ED3AC2} 48603⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2988
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
- Size 1.2MB
- SHA256 1325326ddf585060297921e999fe0cb12d5eaedddb1f10396f278f25a9938aef
- MD5 9a7cddf417d6bc99a8cf91597d5ef89a
- SHA1 68240461f6aa28570c3357d817d3d25c842662b8
- SHA512 21a5a134598629a988ab730d3524052b589862b7b78fa0ec850ecad31da1d046bf793051d8a05cec65b87fbc413c43097463fcbc5b6f9a40f05bf72f8bd57b57
- SSDEEP 24576:udF5mNJAmlCwp2X1tPVBjxux4ACD/iTAbD+Ome2:C/wAhADTAGOme2
- TLSH T14E45AE253A81D836E0715CF980BB4F747674B8A15E2109CF57871B3E28B7A805A3EF67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\javaw.exe
- Size 1.1MB
- SHA256 8b5b9248088548fa4c90df8ae084bd57fbc7dc18f8745cbb15085760833c5103
- MD5 9285f56027315e77f6d3b480cb36f5b6
- SHA1 38980c618f753419c57efae0bce197720ae00f55
- SHA512 04e4484b6bf9fa54705a0208d54f487d8b3b8ffd381104be305e7c07c347be379e5245a3d7463698c617fa127594500fa3c20aae3a15cbef997dd6299759f8e9
- SSDEEP 12288:VzPxS6TqdgM0Y0JdwiHuFDBlUHL8dwuWNWw5iQdBWFCd9/WYoaLHF3z0z04PDvhD:rS6TqYY09uDlU8dsNjYATWaLl3z0zDD
- TLSH T15535BF053AF599A6C83A453481158A96ADBE3D470A23C53F26E1250EBF73315BC6FBF0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Internet Explorer\ieinstal.exe.ico
- Size 3KB
- SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
- MD5 f48ab39db9ca4956776a50b86a8e8c81
- SHA1 c8f6dc9e0c0ffaa61075e9d02ffe0a1a319dd842
- SHA512 c122c826c7146e86238bb8098c91abfb8270f72e4cbb8af9d5664eb98a181376f8e5cbdfea31050c9df1d895225d6c70a06810c91d40f24b1798936682c7897c
- TLSH T1B2619526B216ABA5C11A41308C8F1A2E1632AE4184A6A0010B753983D27E63BE33687F
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
- Size 4.5MB
- SHA256 86f0f30f799ffb280269567bab63762e74512ad534ebcfb669fafbfaf7915abb
- MD5 6f2d82f085706934bb66a3c0f37da95d
- SHA1 80ea3242b215563f177b7e3cf2f8d6425a3f01b6
- SHA512 2ee2f21d399fc5bd7f122ed607e9b07b71843ab3ab095f30dda14fa98973dcabc78a5a0596b8496fcc1f10505ed4626b18ad62357b7eb10c9c89a0313cfb58c7
- SSDEEP 49152:K/uh3bfctrJjP3KQLTi1GL6tSXAt9J4W+8Z0+0GD0AGeuVEusJ6LNzOeL0GKVIe3:0aotbS3lSeuVlcm7fwKAX
- TLSH T1DD266A03B2998894D059C074CE068572EB66BC4C47F5A2EF3690BBDA2E73ED47B39711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.ico
- Size 3KB
- SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
- MD5 cc055af6d5fab0514052a985d406293d
- SHA1 6c856938f56c75841cd93bbe467d624e2bda6e07
- SHA512 4f3387c19d12e5154841d97b552c8c47e107a4bc6ac376fe7a60493d4013572be61886d7ee8e40acc62653c97b3a761097f8dd3d97d72d361c38775ec512eb63
- TLSH T10F61C864933541DACB8DDAFF541843A1AE22C875D73FC4868271E9A33DA92FCA800C2D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
- Size 2.2MB
- SHA256 5276f9bde706dc52d1e67369a01fa927a081786361d7c88e80fc415b9ccd930f
- MD5 b90f35ac2554ad5bdf4f8a6bebdfbea4
- SHA1 a4b520b0b154ff9687c2b99e826e303132825255
- SHA512 94eed08a577fad03eb2a232e90e7ede1a1ac54432d45763b8e0be08084a91d4abbda9d42c7655a821a5d092f80909d5b7eeddac07bb4693b06e4040056c543d3
- SSDEEP 49152:Nb9T+l9c+74YaSY2fF8FhmS86IUJWQn+6h27d6:x9h2jbOjjsts
- TLSH T1ADA58D0BB69B809CD069C0F4CB068935E5A27C420B24E5DF1BA4F6591E77AF47B3E760
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.ico
- Size 3KB
- SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
- MD5 6dd3d92bc5e7a45a2001a77bcc1c1fc0
- SHA1 e942bc4b46d6fc683babd5d21da30f195aecadbb
- SHA512 c8d9b2166f432da32f91d8de3162c74590c5753757c6a00bf9835c7c096c29bbf9ece24eb8688e2b87f137129fdaa9be3770a4eee1b99258e39247a3de64f6c2
- TLSH T189616E7C0F7CDC6FEE9230B9624A0A4132B0CDE15670A6D756127806813DAE2D9F4F9E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe
- Size 993KB
- SHA256 6181be3839fb27246c9676cf1324b2918cd8456f5c84a89654942f0d15c3f252
- MD5 3dea3cd046ade03542addbf3145fd32c
- SHA1 fb04e6687b6bce8de44c851f78bbc05c2c3c1173
- SHA512 b531cbd3ac7dc38878fb5e25d54c74ad7ffb7837ed3da34e0ed52f938881cd03f7813f0a9cef8b381824a5dd2d239714e920ad4b0360b46d4a3af6a022910194
- SSDEEP 24576:UvFr2FIElAg8YWSWNVPxdtNIfiMSUxlXMB7lbht6Bna:UFr2flgS2SMVlNtqna
- TLSH T109258D05E2F484FBFBB67D301BA61A35A537BC72AE30A6BE2544257D2D309014D21BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.ico
- Size 3KB
- SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
- MD5 70f7eb6f0e42805134583ac203c2dfd9
- SHA1 fc513300d133a9b8a45da81a72a10b937e909190
- SHA512 bf3126bfc018c3890afc1a105db52b9b332ed24228cf1a8e1df715287ad51161ff3fa94c88ef2cbcdda9a10bdc992691b9171fa07cfb2e8b71c35d12605a1179
- TLSH T1A46144423D3ED9E5C80005348C5F0FB80A315F92B810A30287BBBD6ED9B8754E61E35E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.ico
- Size 3KB
- SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
- MD5 0becb6bcbe9400e6d9441ceef104e743
- SHA1 2f4e955a4c3c11236501b5c7ea36a392a0891ed8
- SHA512 f7fcfe5f5274d2a27f233e5e67361988b8176497a9711767dac1bf0079a4b6cf5a1dd62750775b25c269169be6a1e3d1faa62207ddcc3d71dbd4e4c928b3017f
- TLSH T10461C6A9BF4080C1E21183F01C831B94A5052E6395EC9B3BB822BC878D7C8EA4038E3D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.ico
- Size 3KB
- SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
- MD5 eeb23b93433af30f3061c261b8368401
- SHA1 87e274077a0eff8831e33ed45b2f740b2d8545ea
- SHA512 108348395c1833031a0abbcd7ea57194733e606fc79cfb6181d821e2e750b53c636977d802c0fce70d64157767d61b7df0cd30fa80535f0586417250eccc9e3c
- TLSH T15961C9FFE23099C8C1467E30408F06C03EBE0E4EBCD01E330A9030A82A39252B83EE01
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.ico
- Size 3KB
- SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
- MD5 de1dbafd46ca8d953c93a1c89766a8c2
- SHA1 41ec8c2a24317bba7a64f4b60341307033edcda0
- SHA512 06a89f154036252f396a9f2ac515c5e03e8dd54eb7ba6c3bd0159f693d85846c4ba1b29c0fdc83f14d8c9128f18db3ee27c73111891dc66f81d4fd14361e6ce2
- TLSH T1D861565C04E3ACB1D6E548B83235B2C460D88A364424C867A89D7AD7CE7D8D473DEB0D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe.ico
- Size 3KB
- SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
- MD5 13fb0b721f1a5288bba88efe12d3c4c2
- SHA1 08899424be48b76e1189abac3b067cd19398282d
- SHA512 0fac8e02873e36841d4a6aaea8d4e7d2c034fad2a0fd18d9a0c8973126dd0d969bd108eaae19fae2f5bb3988bc77fd70405b80a76b68e398a880dbb496b9b3a3
- TLSH T17D61B974F1C12D6ADA1A1EB662BE3412E1B27F8207015A1C091FBB5C17FB32034D9EB9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.ico
- Size 3KB
- SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
- MD5 fdb893a42e2519f60a9a943e687de76a
- SHA1 9540510a3415d3bd50ec0416ec72af6809e8711e
- SHA512 6c783bf16856305121dccb03fc749c66edaa063f730f274312bf29531b3abfd43c860196442f2e566800a383237c84a04a1bfea6fbb2be94004ada693b733c7c
- TLSH T1F861F7C443D872C3C8ECF234352AA51B5F95BA211410BE1D0EAC67C8BAA9E33FD5401B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe
- Size 4.8MB
- SHA256 2d70b4d4aa30c06cbe0606d1eca7a91e5d042203039e398fc8d08ac1b391c0f0
- MD5 7e9787be6d35abdb861fe6164b8a65ca
- SHA1 12bc1f58d1e8dce1cc2e091b763ccaaf088feb20
- SHA512 f58aabca963fa11c0f37fd7cd94434be65e4738ba39d0ec84104e6f87e769aeb12e14862e5cf830ecf1a2a51297e05a0038dcd492beb435ec760d00bf631a30c
- SSDEEP 98304:fFqt3caWRPNLniBaEJhRELqS/rhwov59SRZ5Vb9sybbsK+0rnsp:dqqZ1NLniBPJhRELqS/rhb59SRZ5Vb9e
- TLSH T1E1369403FB599C36F189B83036C1872BD192BD6118D201B2E99CB5EA477ADD334F61B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.ico
- Size 3KB
- SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
- MD5 1e135e5bf5dbc0a82efa354c532e9c26
- SHA1 b49dc6821a4e21d4c9f4385fb7658035a867dc82
- SHA512 5e62520decd7db2d44477ee6e11da45bbb356138bf9482ba873b2cbaa69a44249b0515ee61a3438d835a18bb9fb2e229eca6d5a5da262938ac62245f539d8700
- TLSH T170618442693E89F8C5550530C9AF8FB00F341C17801095428733BEEFAEF5B60F62B668
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe.ico
- Size 3KB
- SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
- MD5 c8d18488a47a8054af9be67ebb94b6a2
- SHA1 d231e824dd885833a1d6875741745994fc08ffa5
- SHA512 1942ffe7db988342597c781a820b65b74dbf89862ea505285a1a96bafcfa48ac8f5b8f583aae0ccc0fe00bb3b80b897c61a87142f3b5f4274740fdf34256bf3e
- TLSH T127617E03F704D1A8C9883FF0F193022F32710D3614602F030B2DB888A9B10E8C426DBE
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe.ico
- Size 3KB
- SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
- MD5 cdcde2807eee3a72d0b027bb11969739
- SHA1 9b5bf494d53c68d3959d44c8e8cba399c55f2745
- SHA512 aa91c211ec2ae00bc635958145b12ab7ae002e52f5ce7753e0790e96d9c61947a88b34b79e580772b53cc2492d5eb8bb69596d4de2106c1400ad64b4cceec645
- TLSH T1FA61AC5B72564B78C803D7719B228B5CF4AD7AE8E5324200C970F4762F24DB53B496BC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe.ico
- Size 3KB
- SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
- MD5 f142fd1b4cf10595f4565171b56388cb
- SHA1 d8cff8a45fb7b27e34c9fc21eb672ff0a1d4076c
- SHA512 3d045c3ceef64b1402605c9a0eb19d65c67f79553de4e21cdf935a0054475699102c25dab9cf3c36c9f9da0b81f350c81dc148726d0fd2e0717f961593dcd3d9
- TLSH T1F861C671A4323D58E54D573C8349B7D0E6064D852DF122AF312379BE0A741ABAAFF1D2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.ico
- Size 3KB
- SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
- MD5 bc5b17be640393be725d1c6bf384febb
- SHA1 7acc0bcd224dce982aa2c109bd091b85179dcaa1
- SHA512 ac17cf409d1652db87b91818d2a0f9a88136fef55389c2e7e3d2ec61b5d5012413ebf9dead6686fb0a16d5197a6af2c1fb6250a1dc46685c8350897ab6655eb4
- TLSH T18061E401D9E71E91FC23E2F6E60252F8327018780AD3112D79EC2ABAE5A4F0B30073C0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\RCX1E31.tmp
- Size 788KB
- SHA256 8508d7ae21b07567d123563519611669bd8d427a1c2f9c9ea79b8e0bfedaac62
- MD5 2af29fcc0d3641519954ca667c2c6d61
- SHA1 ccb39331a0af792ec649a4076b5a12512a07ae09
- SHA512 50626adfbfe612c52df5cd0693b74926ecb558c9f54025da6eb0e4f7469cec7b47a2d2a4ce42cb81b184cd523dae2993bd5162d38c640b2838c1537aad4b4cdc
- SSDEEP 12288:s9zWuNG0ncJ2NIUn8VX5YF++SVLNNgbwAtbNohUbnlcw5ix+kf8fFNIv:iuJ2a08VX5a+RBu8Grbj1keIv
- TLSH T19B05AFA97C7280E7DC0C1930888A4378AD65AC2D9F4A5607E72BF71D5D63C11E1B9EB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VideoLAN\VLC\vlc.exe.ico
- Size 3KB
- SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
- MD5 0c328d41f4955cb0f6d408c63512c280
- SHA1 3bf6219e411e79db50b8fb24557c692c5b82fcd0
- SHA512 0185abba75dc735bdcc24a2d4003943c2a6a88e63eb806a058dbdc4ec4691ed03b7233e60d38e251ab6297f6eed1f446a9644b851d02fc14723551168436e762
- TLSH T18E6163703D321388C04B66BA86133A335E2A2FF61D43C6109B25728A2650FE1CA2D5B2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Windows Media Player\wmplayer.exe.ico
- Size 3KB
- SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
- MD5 44102aaaf107a6544eef73219f2c5f06
- SHA1 c260d347155704cb817de08b8e72468897c446b6
- SHA512 f575a3f5b83ccf08331c23419606414f487ad46c753ddd1b52cd15b89991e61f452f75b8162f88c29e0382c221ae4b9649560eda5138f82cc9a81b031f95ff3e
- TLSH T10A6167FD198B18C7E0054BF6C122AB421FC56CA15F071962EA80B54D3B316DF94D022D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
- Size 1.2MB
- SHA256 6ae2573bdb67d3243b0777d38406fd837c8ccb95f93fa4670142aac7fc1accb7
- MD5 94e0546f361acab61716501bdef258a6
- SHA1 f66c762662f39cbf1cc613c1ad8f683f43e6d6bc
- SHA512 acfed214feb2b73492800bd6f4448e3cb78fcdfda191c06e748e5130ce15a295e8d6564ff7e2c8ac0b964ae6c51a8d82dc584d5ae7c9ad7e02f84af3a6e6c7a3
- SSDEEP 24576:cntvMw+VIqoB77mpGA17Y8oZD3npi63iC:kLBGp9toXpiMh
- TLSH T12E455B5BF6E4E031F1B396349DA9C3584E36BD298F37821F23BA662D09785409D24B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
- Size 1.4MB
- SHA256 bf5623eb81d6ca3d8a8344ee2113fc339f2eacd541a7a6fc6d21d70bd95250cc
- MD5 11befe06a07ffcbea2165f8c67c34a7f
- SHA1 500f661b971fdf4013ca252912a937d2cb02a8ef
- SHA512 ff6ae5a7b9b71729776cc098510b67339341d109967410fa357b9dd4473a645c570c59661642f6131ea7b3734e854a5d4392ac7ac1471d2dec70120acfe2d0c7
- SSDEEP 24576:iR/5FabXAqOmfj5VMysZgjS1hqgSC/izGfU2JGlbhlAZ4/:iJ50b3RjvQo0nGH1
- TLSH T1AD65CE3AA455C436DBBC0B32ED654ABC6E3DA718E70D4E5B52D4AA1C2EF804453B7323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe.ico
- Size 3KB
- SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
- MD5 5cc1166b9cd6f8310369f631daf2f737
- SHA1 8d2e3162e9b8ca7d196be95fc3b6e5b09e41ff61
- SHA512 647617515c2750dfd460994a818bb759b40f867990102efbf592eccee7ed5460e7b731c87ae79af42cd18ccc16d8061102123747aa87a50e059b1490ae6e5411
- TLSH T10761E3576E5C8048DF843D31F4B6EB3003A3ACC13D916676A211B725EEBA3D399187AC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe.ico
- Size 3KB
- SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
- MD5 ea27d80794552048d73d1fdadac459d3
- SHA1 f976de7f799d750ea73fdebefbe57ce9d81844d9
- SHA512 f526d0d089d25625f6c24232334f0b1a18ec7682769d7c2ad6ffeef6a45231c8ce807e8276874e190ac7c9a9876432cc900c567042f6c046015f22aafd121753
- TLSH T15C614C71E91C517CF2D452334146120C440E4D1A19F51F401D333B18FD3D6A5552CEA3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-07-06_92e36b0c0fa7c5e667d72a599ff9d629_amadey_coinminer_elex_smoke-loader.exe.exe
- Size 460KB
- SHA256 8a82644d1fba6441f0a8fb5b7d628f877b2ec830635129a40a1e2173c493814b
- MD5 eea724d76b6bc54548ed63ae7cd57e89
- SHA1 dd04eba87b52faf01682ec2110d02e7b1c454223
- SHA512 846e9e25fe5c428d577b7b4bb11cf356fd39432e1539e7aa83e58d6d3d786471881affc216a78f5040f5ce127fe28e0c5a01924a87debe9c1ec36a88ef2b6361
- SSDEEP 6144:NqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fAx/Wf9:NqIOkU8AMXE9B7PElZlP41N+4PUWfo
- TLSH T15AA46D31A6A45037D6F106B3F914D2307E7DA2187B1184AB9394AE2D3EA85D7A7F7303
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\logo.png
- Size 1KB
- SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
- MD5 d6bd210f227442b3362493d046cea233
- SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
- SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
- TLSH T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\wixstdba.dll
- Size 117KB
- SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
- MD5 a52e5220efb60813b31a82d101a97dcb
- SHA1 56e16e4df0944cb07e73a01301886644f062d79b
- SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
- SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
- TLSH T1F8C36D113BF49071E1E6163D4929A3215B7FBA3199B0E8CF6B484A5E2E711C1DF7A323
- MD5 SHA1 SHA512 SSDEEP TLSH