Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 23:33

General

  • Target
    2026-10-02_e8711b5cb0cf123c7792ac38c4f195e0_amadey_coinminer_elex_smoke-loader.exe
  • Size 1.1MB
  • Sample261002-3kc35saa98
  • SHA256 1b5a59e610e2a5c65c5e948e3a8fb4229a626353047bf366a6261363e713d0bb
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_e8711b5cb0cf123c7792ac38c4f195e0_amadey_coinminer_elex_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_e8711b5cb0cf123c7792ac38c4f195e0_amadey_coinminer_elex_smoke-loader.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5844
    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_e8711b5cb0cf123c7792ac38c4f195e0_amadey_coinminer_elex_smoke-loader.exe.exe
      C:\Users\Admin\AppData\Local\Temp/2026-10-02_e8711b5cb0cf123c7792ac38c4f195e0_amadey_coinminer_elex_smoke-loader.exe.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4176
      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_e8711b5cb0cf123c7792ac38c4f195e0_amadey_coinminer_elex_smoke-loader.exe.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_e8711b5cb0cf123c7792ac38c4f195e0_amadey_coinminer_elex_smoke-loader.exe.exe" -burn.unelevated BurnPipe.{E33A4586-B9C1-423B-86F9-2B59FB6DC5D0} {E0A79C56-AF55-45DC-8172-824DF3D6381A} 4176
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3356

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AcroTextExtractor.exe

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
        • Size 766KB
        • SHA256 6757a291415d1dcbb85ee5f03592d85e3250bf0315a7f295c3481a4e2ea3477d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AdobeARMHelper.exe.ico

        • Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe.ico
        • Size 3KB
        • SHA256 2f33dacaebb8bdf6d2d88550cce349c09b51dfeb4f499796f32bd30e14aab86c
        • MD5 SHA1 SHA512 TLSH

        msinfo32.exe.ico

        • Path C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.ico
        • Size 3KB
        • SHA256 5d7967695bef88a64140c541a09f22b45abe542c2df462d800e72e1d8e121d28
        • MD5 SHA1 SHA512 TLSH

        DisabledGoogleUpdate.exe

        • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
        • Size 6.4MB
        • SHA256 6ed3abe7c0a1cea765e608cec599a95f83c2e6bd1245ea0854ebcc64a6c2a02f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DisabledGoogleUpdate.exe.ico

        • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.ico
        • Size 3KB
        • SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
        • MD5 SHA1 SHA512 TLSH

        ie_to_edge_stub.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe
        • Size 1.2MB
        • SHA256 f661c0469aa80d6dc9d1b578c25a6a9e215e7cf2d8727e6d19673df348704042
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedgewebview2.exe.ico

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe.ico
        • Size 3KB
        • SHA256 61197ae03a1910353d202dffcc2271af59a9c26150652fbc6a84806cef420176
        • MD5 SHA1 SHA512 TLSH

        setup.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe
        • Size 7.7MB
        • SHA256 84c2dc56d580e1491f49a05fd69d0a52e6b6c756423fa5127c43f17d95dd172c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedgewebview2.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe
        • Size 4.1MB
        • SHA256 09eb2548dbf906417fa81f67d9a46323ae5991152bda70a83149e05e77755f9c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe
        • Size 2.3MB
        • SHA256 a5b913f9627a1ef48f321feded65bc8643c6719fa2e5951f396f9dc557276e27
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MicrosoftEdgeUpdateComRegisterShell64.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe
        • Size 936KB
        • SHA256 2f44ac3b5e3311ffd5cfdffd23114215b192f21766acba186edf88413d8b7b36
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MicrosoftEdgeUpdateComRegisterShell64.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
        • Size 935KB
        • SHA256 8098dec9b99509e7337eebffdd726a62de348a780033b4f03cddc41254336f9e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MicrosoftEdgeUpdateSetup.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe
        • Size 2.3MB
        • SHA256 04cb72978fddabeefbe31703794b18d413cc5b3f38890d1d057472de02e677d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_click_helper.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe
        • Size 2.1MB
        • SHA256 d7d871f4313d1ea0384092d3d69b37a79b57dc88de7c9a32a7f32f571b37f37f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe
        • Size 2.1MB
        • SHA256 e2dbf9bae830cd2a065a496de6f66578352634d7a198460bf23e57f17410d96a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        identity_helper.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        • Size 2.1MB
        • SHA256 b6423c61081c85f7944083da9707b52a340899691e6b783c21bca452db0c4653
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge.exe.ico

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.ico
        • Size 3KB
        • SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
        • MD5 SHA1 SHA512 TLSH

        msedge_proxy.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
        • Size 2.1MB
        • SHA256 37564c66fc84973ceb35e13749ed63752283cc5e951515280083d6d3573a77c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
        • Size 820KB
        • SHA256 c95f6f93eb2593ef73846db0978874d4ed7a954739747ea9c2c1b79bd04beca3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wab.exe.ico

        • Path C:\Program Files (x86)\Windows Mail\wab.exe.ico
        • Size 3KB
        • SHA256 ce19242fbf3efc4fe158fba6ad17e913a57a5fe53166f47dc8e5faa5a9f90a03
        • MD5 SHA1 SHA512 TLSH

        wabmig.exe.ico

        • Path C:\Program Files (x86)\Windows Mail\wabmig.exe.ico
        • Size 3KB
        • SHA256 88c0094fb49858d277e6e56c8c1023bf93356b7d3fc8e037b355d21aa1c7bd34
        • MD5 SHA1 SHA512 TLSH

        ImagingDevices.exe.ico

        • Path C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe.ico
        • Size 3KB
        • SHA256 c76b2392ae75384d2097bd890c529cc5636350476c9a001ee1a055430c8f1c86
        • MD5 SHA1 SHA512 TLSH

        7z.exe.ico

        • Path C:\Program Files\7-Zip\7z.exe.ico
        • Size 3KB
        • SHA256 463b6e99198762de39ea3c9156504527673355f452c17063d0fcc34caa3cfded
        • MD5 SHA1 SHA512 TLSH

        7zG.exe.ico

        • Path C:\Program Files\7-Zip\7zG.exe.ico
        • Size 3KB
        • SHA256 8cad493433ec34a34ca6f4fd49655aaf7cbb4337752743804db83ea6c050d1fe
        • MD5 SHA1 SHA512 TLSH

        OfficeC2RClient.exe.ico

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.ico
        • Size 3KB
        • SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
        • MD5 SHA1 SHA512 TLSH

        setup.exe.ico

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.ico
        • Size 3KB
        • SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
        • MD5 SHA1 SHA512 TLSH

        ielowutil.exe.ico

        • Path C:\Program Files\Internet Explorer\ielowutil.exe.ico
        • Size 3KB
        • SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
        • MD5 SHA1 SHA512 TLSH

        javaw.exe.ico

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe.ico
        • Size 3KB
        • SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
        • MD5 SHA1 SHA512 TLSH

        CLVIEW.EXE

        • Path C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE
        • Size 1.2MB
        • SHA256 58fff3cf2904e36b3576295a44c367953278e8eabc2c6fc7b66beddcb425ef71
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GRAPH.EXE

        • Path C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE
        • Size 6.1MB
        • SHA256 7060577e5c8550ecc715cf8a9cfb65d581ab92f75ee592480b56d8ecae2a67b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PPTICO.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.ico
        • Size 3KB
        • SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
        • MD5 SHA1 SHA512 TLSH

        WORDICON.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.ico
        • Size 3KB
        • SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
        • MD5 SHA1 SHA512 TLSH

        excelcnv.exe.ico

        • Path C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.ico
        • Size 3KB
        • SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
        • MD5 SHA1 SHA512 TLSH

        DWTRIG20.EXE

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE
        • Size 1.0MB
        • SHA256 ffffbe08c3d2b29ea1a603086214702df761429bb74b28c5fb58c64efe8d466f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MSOICONS.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.ico
        • Size 3KB
        • SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
        • MD5 SHA1 SHA512 TLSH

        MSOXMLED.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.ico
        • Size 3KB
        • SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
        • MD5 SHA1 SHA512 TLSH

        Common.ShowHelp.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe
        • Size 758KB
        • SHA256 893856c86c2ca54963740a6faaf11b19b8220b841a611a2c03afe12be4dde733
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dbcicons.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe.ico
        • Size 3KB
        • SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
        • MD5 SHA1 SHA512 TLSH

        joticon.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe.ico
        • Size 3KB
        • SHA256 f4c419b2d60ebe6dc173b36b108855b1f4db9c28fda291f4d93ac38e6dd24389
        • MD5 SHA1 SHA512 TLSH

        osmclienticon.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe.ico
        • Size 3KB
        • SHA256 b76444a386ad024bd78ee152f0f6ad2d5dd3b9ed478147014e5d804e7a9e6508
        • MD5 SHA1 SHA512 TLSH

        outicon.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe.ico
        • Size 3KB
        • SHA256 98d0a0fe25fa36309c0bbe62f04a561a1e02d51a4dc2c8331b9b3c2e47387f5f
        • MD5 SHA1 SHA512 TLSH

        firefox.exe

        • Path C:\Program Files\Mozilla Firefox\firefox.exe
        • Size 1.4MB
        • SHA256 613453fc5d82dd8e69e9ca8d9c2951497fcab40c160b83f8aba789968bc9ad26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        private_browsing.exe

        • Path C:\Program Files\Mozilla Firefox\private_browsing.exe
        • Size 784KB
        • SHA256 2437365348db2e80431449346f491eb80ec810ad73cd06229a4d86de367f9ce5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        helper.exe.ico

        • Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe.ico
        • Size 3KB
        • SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
        • MD5 SHA1 SHA512 TLSH

        SetOut.exe.exe

        • Path C:\Program Files\SetOut.exe.exe
        • Size 716KB
        • SHA256 4c8bf67ffe8c88581c278c29b638478cf945d42f665b7036a2f5355516dcf783
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vlc-cache-gen.exe.ico

        • Path C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.ico
        • Size 3KB
        • SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
        • MD5 SHA1 SHA512 TLSH

        MpCopyAccelerator.exe.ico

        • Path C:\Program Files\Windows Defender\MpCopyAccelerator.exe.ico
        • Size 3KB
        • SHA256 02221d573edefa486ba8fe5aee3c8a10c8c7e3188914c0f22df06bb1338db790
        • MD5 SHA1 SHA512 TLSH

        MpDlpCmd.exe.ico

        • Path C:\Program Files\Windows Defender\MpDlpCmd.exe.ico
        • Size 3KB
        • SHA256 9e3f1f8e5166514df44b02a1e0bf7474708dafba161e263cff087af62ba89ae5
        • MD5 SHA1 SHA512 TLSH

        wmpconfig.exe.ico

        • Path C:\Program Files\Windows Media Player\wmpconfig.exe.ico
        • Size 3KB
        • SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
        • MD5 SHA1 SHA512 TLSH

        setup.exe

        • Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
        • Size 1.1MB
        • SHA256 9616fd3f151873a5e7bcd7cea51731107a964e776435525171c33973980a4489
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcredist_x86.exe.ico

        • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe.ico
        • Size 3KB
        • SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
        • MD5 SHA1 SHA512 TLSH

        vcredist_x86.exe

        • Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
        • Size 1.1MB
        • SHA256 bb2e4e62a6bb240c9cde08894aead58124a40ab57cfd99919e4eefd564dfeea7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcredist_x64.exe

        • Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        • Size 1.1MB
        • SHA256 eb1ed55e94995f0932f4719c1e98dfd3cbf67b0cd1003cabb7e65a70cc1d7fd9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        windowsdesktop-runtime-6.0.27-win-x64.exe

        • Path C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
        • Size 1.3MB
        • SHA256 e9c120a827eb21e1ac63c4b5496ba1a8f783f8190f445ad3627ab5c14d5f5e51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        windowsdesktop-runtime-7.0.16-win-x64.exe

        • Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe
        • Size 1.3MB
        • SHA256 102c9f95a9b85cb38303ee0940bc17c4c88729a57c7cf40989c42d0cfbc37294
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneDrive.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
        • Size 2.3MB
        • SHA256 1ff2ea2cced425d5c5a32668efcd8e87c3ae911e6801b683d7ad417f6fc381e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneDrive.exe.ico

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe.ico
        • Size 3KB
        • SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
        • MD5 SHA1 SHA512 TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 01f2240f03d12c760d493d9f1e7cc2939642e89e4e1fcaac2cc628f4c7c106da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 0ef8459ed5086ab10cebb16f4910645366cf9ea0d15bedd6d275a3387935f256
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 f432a257ab2c6dc558fc56bca7f7f47d3e9c610514c81fa655368339ae25655a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 64c11318722327c0e38afc06d009db0fa0d0e0dfb19d16fd598cc839a1d88957
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 05d4a1e023b2ee4bc348349cfa825aee25eedc540585fd81684712cfa0dd50ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 6311d4928b866a5e182f7f7a4fb64b2fa2f03295d2a279a3664914f89a534928
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 7adbfbca8fd43b53d0da2ffe5b439379d4e9443fd2bca8e8a3c03fb015b4d0fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 3e53c9066985696e0c73caa252984d6ff5dd08d238ee176d6926104d38f2fa16
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 83131582b841904c729cb949c99810ae8c6b7e09168ee39375ffa558e09b31fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 1f316866a8c52b3dd868b41130253455d13d204938be8a684ee6ea113dca3085
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 dcb3a11816b79c127dcfd118d2d633e3bcb207e89f8efc6223b11a548d1eed39
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 27668b4952e92e0ca72cf443b73bf72c13b931c09a7721852a85def6b00dc4ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 b91ea4588e196c2840d967e6e2b7295b43c5d6dcb230839182537411b17ae199
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 85f92a311dd17f2e1b6abd0002304db8799cd26e4784be2f4c1fb3089f786bfa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 351d47f35fead079108fbc7b0c19aa83334055ad7522b1c2d9c760bffbe35559
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 b227354a4da8d63a595b66e15f8217e7e74440ef9adae2b50eb59f10ec39a309
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c9d740b286c3d7b11e1785e9070dbc2621e4a3f15c75aa1da6c4228cca1dc245
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 34842cbc153b30b9c5c535e018fa84a2fc7c48c8e4ac05df82c2373fed95e261
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 e45ed2eac42e0c4ee31bcff6863347249c18c2ef53bac753b0698167d02b249c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 57b417ebc54da0a51560a4630beda3162662c5fa91c0087ab9d266514adba002
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 2dd2206a51d519a9e66d6e1c56fe7abae2f756b5dc74ac0a8cc7808f4bf513f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 828c4b9e6c17a093aa8747387379fb8b491083c95ce85ddb146f153566c72d62
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 8fd4d6e21a7500d330d647fd147c65ade9c308c9f909f7c8fddb9ae7c93f3886
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 8e32a246da568c63887ae48b198f2fa024353a748a38ade262ce0e91cf930c62
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 d92f4d296e36713ec23dcaf666400eca72b9350f6991aa4870cbb5f0edb6d18c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 d3b1f2cc2f64b717ebb277a36068636fcdb71f197cc0589f07b5e11980988394
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 55638130f35913ae69046508eccd98921154c15420e375b60d80195000fb9133
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 a09aa4d59dc1761a02c93ecd3ef06858fea3d170f90c6fa4259a3160418758cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 be6078813953a05d938804128446bb90abd13b0a0241649090e0cd2502cc8aae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 62adcd5e6967238c6f9858e299d44ed1bdc650ac263d6fe32940b85de96340dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 a480d399520d529ad7dae722f624c66e9e92333169085c14ce378d1f13e0ce8d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 e4c2cdef843a4b5ecc3360160ca20bbbf9560d34c7cb6ebe899d7770cb789d97
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 2356df0104acd9852d524b2e14902f3c3e2da340cdb182931c2908dc9a9fdbb0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 766147665f83c1ac01977f58f0772b381f8ad4eb1c895bd8dcb54e3612f66400
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 dd12f23eb07765fb93a893a8d627089b076785b1f5365dd1a596a556fdbf2570
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 79a3bcce2469249f91b94c05c982df4abd1ad49974167001db36b45930e9f6d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 f6d8ebd470c7a3fca9e167782576010bee6b770328eb06f9b972c233fa3ebcf6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 b66f526d1aa923a91135b8d926ce8304693d83cad1e0d5fc60b7783d2ac33fb0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 da10401239f3f1eef8998b8008af8448c442d76f601b4d3b3cc558f2da12174e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 7f608b29339b3442937dead0f4cb3c6e176b89e3d3a8621f5c5f7c49e0c6f9f1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 96b47cfec7733f3edebb584ecef7ab317b0eefa23d01bdee8bcc07de247c44a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 ec1e710c24260e5af1e10b6d451c30936b052d1b5617551a42c53630ba31f3dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 4925ad29ad1daf9e76870c0f88bd6ea3bc7341cf890c9123c76ee2300bff4946
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 e14c4666dd4978bd722625fe0d51af5e65c9cb2deec655d33a0564ee6d548620
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 3009a39ff4ab321b7f2d1a1e9646e6cc657efd3f7cb25cadd20bb05aec9248ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 30f6b94773a48a5ff6578a59e22a160e92feb526ee51fc9433e8be41dd527160
        • MD5 SHA1 SHA512 SSDEEP TLSH

        2026-10-02_e8711b5cb0cf123c7792ac38c4f195e0_amadey_coinminer_elex_smoke-loader.exe.exe

        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_e8711b5cb0cf123c7792ac38c4f195e0_amadey_coinminer_elex_smoke-loader.exe.exe
        • Size 460KB
        • SHA256 449777243bc0205b3e80c85f9bcb770624d4cd7140aff67b242083039137ffa9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logo.png

        • Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\logo.png
        • Size 1KB
        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
        • MD5 SHA1 SHA512 TLSH

        wixstdba.dll

        • Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\wixstdba.dll
        • Size 117KB
        • SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OpenClear.exe

        • Path C:\Users\Admin\AppData\Roaming\OpenClear.exe
        • Size 1020KB
        • SHA256 c50912ea1715efb8ca56d559ec005c3a09a2e6f2512cfad299f956b359ce8c9a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/5844-946-0x0000000000400000-0x00000000004D5000-memory.dmp

        memory/5844-0-0x0000000000400000-0x00000000004D5000-memory.dmp