Analysis
- max time kernel
149s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 02:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe
- Size 543KB
- Sample260716-ckvebaev3t
- SHA256 7ed2c1f3f65b1b7918c51b77002969fb6c58105508ffd1d2ac3a9742e4288e21
- MD5 1fd2b306074c794acd8062f5f6c1c0de
- SHA1 5a4c7fd9ed31a392db8ef7e8cab467d19d0e6d12
- SHA512 caba2d442a06bc8b6cc557118a6f50f5f2fcce4db5dc7f681ec49c9214f5020bbadc9edaa52dfb37166ee81acc5f503249e31b6fc63b2e71ef9efbd7b46f3037
- SSDEEP 12288:+CyNymOcB+pwPprnVmLmDsC+FU+ZOSzDBtzY7UWfR2:72LOsDFncLmKDZOSz1FO5
- TLSH T1FCC47D31A65C7333D2F105B2E91CF2307D3DAE186F1084AB92949E1D6EA94D6A7F7203
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (259) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 2 IoCs
pid Process 1692 Logo1_.exe 1268 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX9AAF.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\RCXA62D.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe Logo1_.exe File opened for modification C:\Program Files\SearchCompress.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\RCXA660.tmp Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE.Exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe Logo1_.exe File opened for modification C:\Program Files\UnblockRedo.exe Logo1_.exe File opened for modification C:\Program Files\UnblockRedo.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX9620.tmp Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.Exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe File created C:\Windows\Logo1_.exe 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe 1692 Logo1_.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5228 wrote to memory of 1668 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 88 PID 1668 wrote to memory of 5668 1668 net.exe 90 PID 5228 wrote to memory of 1696 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 91 PID 5228 wrote to memory of 1692 5228 2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe 93 PID 1692 wrote to memory of 964 1692 Logo1_.exe 94 PID 964 wrote to memory of 4888 964 net.exe 96 PID 1692 wrote to memory of 5172 1692 Logo1_.exe 99 PID 5172 wrote to memory of 2880 5172 net.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:5668
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A7.bat2⤵
- System Location Discovery: System Language Discovery
PID:1696
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4888
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2880
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1268
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX9FE6.tmp
- Size 158KB
- SHA256 5d180b0dffef3786173f03a2b747712015e76cf131363b9cab522d0616fd5584
- MD5 9eb4385b17db72bf42b50f5867fe5cb1
- SHA1 c82a32b408f43383a082b213b7241989073d7b2b
- SHA512 180de657bad03ca8e5aceee2eec50dad02a786c3e92c1d2df3e6f46900554a2aa25b2af929f4c9b5d6d9856438bceb95420e0a92eaaaad8a958cc4bd7498db0f
- SSDEEP 1536:I7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjx58m3G5QGPMLNYN7:ZCSjGoLpWM6VbBgjx5xi3M5Yh
- TLSH T19AF3C32EA14FB3F6C3E1987C8D1DF2A5ED29FE20CE19285B75D93B0E9A760C34508195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXA2F6.tmp
- Size 95KB
- SHA256 497677dd1847aa97135eaed5b4a6670c2ae39942bdc1a7b1bccc7e68a160bfe3
- MD5 362d8b2b504bdbaeca751f5e84860c60
- SHA1 1db6899c949746a3a0001a57e1940b1f2295a195
- SHA512 270dae20fb3657713b37c23ea2010c8c5edc59c6487bab98bab03f6322f7bed1ebdd55967b95f69d05d92bcce5c5c569f95d97144ee0f640a7dc515b9f1c3a51
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxW8m3G5QGPMLGYNL:gCSjGoLpWM6VbBgjxWxi3MqYx
- TLSH T1F2A33A16F28CB3B6C0E199BC8E0FF2E5AD297E205E2D18AFB1992F0DDE765C1550C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXA559.tmp
- Size 105KB
- SHA256 7d2d875a4569ebafe3ecfde02037166b0754dffaa32d41fd556ba27a23d40bc4
- MD5 717010f8882c70c3e0b9c251faf959c4
- SHA1 43e47fc098a2b87cb82fe4e5530c7e6e9f6f8aed
- SHA512 ae54ed30f754a780963b2cd4af9c902c25d00321f3c44d6c6205536cf266da6cf7aef132fe7870a6ae66c78053e5b2eed0f97c02dfdb02bd9c5ca99aa25cd1ed
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxL8m3G5QGPMLM1XkSPsULMHiIYNY:wCSjGoLpWM6VbBgjxLxi3MAdtPlLqZYW
- TLSH T10AB37C2AF28DB376C0E199BC8E0DF2E4BC397D205F19186BB69D1F0D9A775C2490C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA438.tmp
- Size 120KB
- SHA256 99055726344a10dbdd3b3c2ad5413a79dd865b9e45b4e1a626ef9136bd060a79
- MD5 945efafb031b24a6f0a6bb73dd50d012
- SHA1 4ce1a15a178be225785a86d82937eaec65a8dbf5
- SHA512 0cff9c81e06ac706d438fd9644dc9bbdd5d48ecf4803aab5ac696581a2c3b2664b6e32b6681dcbbdfdce744b36b5cdff80d2712d0a848c804edb18c65c64218b
- SSDEEP 1536:I7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxJ8m3G5QGPMLx4GZjzQwK5WW7VCt:ZCSjGoLpWM6VbBgjxJxi3Mje5BV0WY/
- TLSH T17CC3AE26F29CB3B7C0E199B88E0DF2E47D797E205E29086FB5992F0DCA7B5C1550C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXA7BD.tmp
- Size 101KB
- SHA256 2db27100b957eee284a0e22c5a917b0f21fd6a42360272dde8863287bdd1b71c
- MD5 785146147c68935a01b1f7bf2897c4af
- SHA1 0504d86c53b0dec0b44e90172fb3a1a7a289ca92
- SHA512 cbfd1c040e4ca18ef28461f5b2d5ae6b03cce5ce8519812cd71bc4e1a15b1f83e85a12d1443d758744c35cf1edc8b9b03f54fdd1daa70a1f03367c295d002a3f
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxg8m3G5QGPMLeqkSZZZ3lYNr:YCSjGoLpWM6VbBgjxgxi3M0UlYR
- TLSH T193A35B16F69CB3B6D0E189788E0DF3E1AD397D305E69186BB29D3F0E8E77182550C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCX9553.tmp
- Size 92KB
- SHA256 429084360d3399ffcfc126d717794c7576ede9dfdb449962637404a2f9f76b8d
- MD5 e73a6e528f977e59a185a73420c33a2e
- SHA1 ff84f25d18e938f39e057db781104b76a78c816d
- SHA512 70f39c74de0926b4861eac3c7693be1d1f86735ffa05f4ed67be479162295d0fdd7c9edc79c347ab981a6d2564db2415482ebbf36b396b4b928d9dbbbf6eb4ac
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjx+8m3G5QGPMLBYND:4CSjGoLpWM6VbBgjx+xi3M1Yp
- TLSH T1E4935C66F29CB3B6C0F199B88E0DF2E5BD297E304F29186B719D2F0D9A771C1590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX970F.tmp
- Size 93KB
- SHA256 e9c9d05c1eebdf65d741b557fa4d8b48dc03d72efa02ca2d41214869c9431264
- MD5 25a5977453754007c51ef341231c4557
- SHA1 5b16b3cb1a9fc9cfae921b6f1e7928f15019eef5
- SHA512 d45bfe4d04ecb3298a6e6391d45509e3649a79a27b787f3075ac370a90a4a70bec977fc377b00886fa0b2b7c2bb7000da796e6d795f5d829ecdc4bdf7193bffc
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjx28m3G5QGPMLoYNz:ACSjGoLpWM6VbBgjx2xi3M0YZ
- TLSH T16B934C26F29CB376C0E199B88E0DF2E5AC397D305E29186BB1AE3F1D9E771C1590C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCX9A7F.tmp
- Size 93KB
- SHA256 c0d8f8dffb1ee9783dc217f4e2f879deb555742dfa479f5a7490445ed5ad42a0
- MD5 55ab8436e8434fe1a99bb662664c9796
- SHA1 9c7f38c2eab59e697f26fa14b8ff9543696d3cb0
- SHA512 be5d060a32a361bb1d6bc55141a23f6c0ad36ae7e29031d4207283bc7bc0b2c6a90dd89c4ad0e468f1c390143754a9fc3746b9939679da7c4eee25ff4aebfcff
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjx+8m3G5QGPMLTYNz:YCSjGoLpWM6VbBgjx+xi3MHYZ
- TLSH T14A935C56F28CB376C0F1A9B88E0DF2E5BC297D304E29186BB1DD2F0D9A7B1C2560C195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCXAD0F.tmp
- Size 94KB
- SHA256 6c0cf636751038f8152cdeae66e9d8483c82aede73b937a188f573d2bc004976
- MD5 4f63ce6b7eab0ae3c1304046e268fbd8
- SHA1 1d0966e028fa0b4e6cf7e54d01c64515ae073ba1
- SHA512 4b568798207724afe3588a990f1dff69d2572d5c9f816d1ae36c93a38c24f57c8b3c123029fe3af68851533e616f36cff7df168282be57a8a64996b8c709cfae
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxu8m3G5QGPMLC4YNL:ACSjGoLpWM6VbBgjxuxi3MW4Yx
- TLSH T130935C26F29CB7B6C0F199B88E0DF2E5AC297D30CE29186B719D2F0D8E775D2550C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a7A7.bat
- Size 841B
- SHA256 c435a4ed7a3a585c4a06946fe69b62c1107171954a2fad256a4b3ea96f0d8126
- MD5 a4df2dc8107e348cce4ead3a39fe1d0c
- SHA1 60f2935494420193f5725fd7365f8542b1e2e438
- SHA512 b22aebe31f1d608bed13ab76c888764575dc40e14fda88adf51d4ce9d5e5562a61405062e9fda526fedc7dba11bfcfeb89ad0df74424fb9076de7b2d2d1346c6
- TLSH T15E010C034FEBFE2621CAC02A05B199AAD5F49D77190D33536524C2DC47E084BF566757
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-07-15_1fd2b306074c794acd8062f5f6c1c0de_amadey_coinminer_elex_rugmi_smoke-loader.exe.exe
- Size 450KB
- SHA256 6d53d6afdd3ca1c32674beae8ce4251daa06c3be5edac0f9d8a3fa1cf9f5427d
- MD5 93eb7106f17265d71273e638ed551fc1
- SHA1 076c894718ab7109de35ce072e74c57f36c78a73
- SHA512 336f2c7c3d631d6fc1365c5427eb1ebe4907a22dd1cb525caf2f86016a263b5c98e7f413cc4672f81cba7fbd02181425a4740320254fdbbc48df34f3a96f90f3
- SSDEEP 12288:GymOcB+pwPprnVmLmDsC+FU+ZOSzDBtzY7UWfR2:GLOsDFncLmKDZOSz1FO5
- TLSH T11DA46C32A7A45033D6F105B3F914D6307E7DA2186B1089AB93949D1E3EEC8D6A7F7213
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 5255b5af4efceb08b5d2429e836860089aa6287692e9968df15aa37a09ab28e7
- MD5 d3fb49a72f0434e3c2cb8723b17eab1a
- SHA1 e6ff5a99311b1b06a9c6e6ce8cf9d152774965b7
- SHA512 7b0ced63d6042a831a25b378aec5704f2d0a09a0ac6d43daf939abdd72047bbbafde6cadbaae32a72321e34a01d5779637563fc4f123a6d661ea0fe183e9c0cf
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxp8m3G5QGPMLtYN3:gCSjGoLpWM6VbBgjxpxi3MBYB
- TLSH T176935B1AF28DB376C0E199B88E0DF2E4BD797D305E29186FB29D2F0D9A771C2490C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH