e437b2faa15a899d811f123eeb7ef9fb464904ee0a0cc01138a827eb84b2d382

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe
Size 1006KB
Sample260809-w2dbxatcqc
SHA256 e437b2faa15a899d811f123eeb7ef9fb464904ee0a0cc01138a827eb84b2d382
MD5 8e651eadaeaa39b983ec89a50cf72ffa
SHA1 a8418e5c41ec8301bc671b7686b604a3c652cd2b
SHA512 db30429e2e60dd42fdc2ca72722961e28a0f1e4aafcb8995b15e3d17639af3df71af6fee30c1f9f97aa1bf095474f4d065c880b1f25a399a4f11dbf2ecb14c3b
SSDEEP 12288:97+faURs8XbMhmCryZjevG/0Y0EZcuadLULqtRCFIVk2fZo4YVTeUGcr7r/:97SXb6rKSY0EZi7RCFIvZo4K7Xnr/
TLSH
T17F258F61BAF9F231D85049B02E686B759079ADFEEF7103EB5E82365940341D21F30BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
784	Logo1_.exe
3280	2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\he-IL\View3d\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\mk-MK\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.Resource\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\EBWebView\x86\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\de-de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Text\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win10\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\6.0.27\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\UserControls\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\subscription_intro\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe
File created	C:\Windows\Logo1_.exe	2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4728	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
784	Logo1_.exe
784	Logo1_.exe
784	Logo1_.exe
784	Logo1_.exe
784	Logo1_.exe
784	Logo1_.exe
784	Logo1_.exe
784	Logo1_.exe
784	Logo1_.exe
784	Logo1_.exe
784	Logo1_.exe
784	Logo1_.exe
784	Logo1_.exe
784	Logo1_.exe
784	Logo1_.exe
784	Logo1_.exe
784	Logo1_.exe
784	Logo1_.exe
784	Logo1_.exe
784	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 4728	4248	2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe	85
PID 4248 wrote to memory of 784	4248	2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe	86
PID 784 wrote to memory of 3176	784	Logo1_.exe	88
PID 3176 wrote to memory of 4088	3176	net.exe	90
PID 4728 wrote to memory of 3280	4728	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EBA.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Users\Admin\AppData\Local\Temp\2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe"
    3⤵
    - Executes dropped EXE
    PID:3280
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 c69aa4ee23bf34980e86c6dd1fb341b68070dc1bef5ff5798344e84bfaf72208
MD5 ca0ef63db34efc91cd0674c0bb4180dc
SHA1 9faaf3bc0dadcc4c13329d95cab569f43b3ccf78
SHA512 1464f43dd24829ddaa0ce2c23de226a1b5ca68632ad45a2e0e470148e0f16a2200499379dd5601930f1cd941a64e073532ed20d1dbf60b7e538fd17614be9317
SSDEEP 3072:lftffjmNTYCkuRieOVETT+jYPnau3fVGAhoRqzB+NkGHS2:lVfjmNTYCk3ET+Tu3fC0zB+JHv
TLSH
T128C39D1376D084B2E4B2593109A0ED718A3EFD621950DE7B33D51A3E0F316D1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 575KB
SHA256 b3b439ec275d707a2bd22e80c0f8b23758dc68604a4c9f7a3626201c7ce5184e
MD5 1e797aa20680bb6b8093b8bf86b6f3ed
SHA1 e34931f0a9e65d261a4bfb0db83f57b05d7d7453
SHA512 ef52af98e882033ea5f3ce4287307cf8dc5e51f27f4cb032d675c42a04202607034a13aa8f642b6d5dd0dbbe2c1e29933fe4e551fc161b88aa01c3e5f54c7523
SSDEEP 12288:97+CXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:97f0Le5ji0hmxNrM
TLSH
T1A5C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 1f06570aa3d1064cd6e7bb1641c7660e9991de3dfe2f36dcf7168a7ca50f822e
MD5 f2f0fc2163d1d3b8943f7c8ce8652717
SHA1 aa16c31090c81095065f77f884f1a1be1c5bc858
SHA512 a839f70d5294d1971b0d36c98189ce41054837f70fffc9f5232b116103ba4e14c3470c4414b5cdfd25d4abe7cf5723d74671497021f12f095a2ea733ea15db22
SSDEEP 12288:vp7+qqIOkU8AMXE9B7PElZlP41N+4PUWfo:x7/BOkUhMXcBwc04nA
TLSH
T18CA47D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a3EBA.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3EBA.bat
Size 860B
SHA256 0b51594e5f8375cd75a0268dcd29695089ed766c37840121a50047ec1246e4c1
MD5 e1017adecfea84c19a8e434bbbf434a9
SHA1 4e1e2ada9b44716203d6f9fbf2027d0745fcbd07
SHA512 40c1143a11c147be1ba6f36d69b95d23545633c461d5b10f3e476f532a08a8cd05237b6fd8188f16a85b32ee724481e195e356462a59ff77dd4721106164b176
TLSH
T1D81100014379F67A2884904B8F60F82FD0447A2B6A5E3715662CC7CE5AC5C4AF4663C1
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-09_8e651eadaeaa39b983ec89a50cf72ffa_amadey_coinminer_elex_hijackloader_wannacry.exe.exe
Size 979KB
SHA256 00907042e89088616f9fb65d6017341415f65c56fa15c379e514d12a283f815a
MD5 0b1681ddf12618284a6a29ca4817774d
SHA1 492597ae04c962a497b24bcec6d1f5096b1d7989
SHA512 cfe8784e1481c2826c647749c5fa7e5023c396b48517acbe3fb2aeed00e7fbe02f6ba8a96d2bb98fe5311be5cbc589e2eccb5b465ddb1488bf233762715fe46b
SSDEEP 12288:WaURs8XbMhmCryZjevG/0Y0EZcuadLULqtRCFIVk2fZo4YVTeUGcr7r/:wXb6rKSY0EZi7RCFIvZo4K7Xnr/
TLSH
T112257F61BAF9F231D95049B02E686B759079ADFEEF7103EB5E82361940341D21F30BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 1b301776d9eba1270010a8a158c707ceaf69c752c957d6644e952a87f4375a22
MD5 cd45b437750e2d1d99b5364daa7c8614
SHA1 99ba9d50341762530576c9cd60c2bb2b08dbc8f0
SHA512 eda8083bda5dffcb25da054efab1c0dec7b2793171152769515d3f3ce891b2880e6237eb17a1f36b853aae78861b29e4d1e4359858612e504abd9265124d2a75
SSDEEP 768:YsJ1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:XfgLdQAQfcfymN
TLSH
T1D6C2E0F912C96A74EC228EBDCBD69702432D0B79109F282575A391BF2111BB4204EF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-889581200-2041691093-2048517887-1000\_desktop.ini
Size 8B
SHA256 9665de4083439d021866163b21bda2a5f96fd16cd7572fbd2966e90951743829
MD5 fbd4d05c754ca8e6e9927860714ab856
SHA1 70f0865f40fc4cede69e788e26ed14ba0a05a242
SHA512 cab7618c5a9e453f59e89acf2cdfde870b9c226cbfdeaa200be64076935cf258481018f241f15ab258d2dc85534ce3edfc3f3a27a7f035cd4c3a16fb03a88b57
MD5 SHA1 SHA512

Submit Download

memory/784-27-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/784-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/784-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/784-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/784-316-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/784-1246-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/784-5035-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/784-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/784-5540-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4248-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4248-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download