Analysis

  • max time kernel
    148s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 10:03

General

  • Target
    2026-10-22_698c57dd543163c21a0d871794682947_amadey_coinminer_elex_smoke-loader.exe
  • Size 1.1MB
  • Sample261024-l3bvcsa12p
  • SHA256 ea131acc33b9def142fd89dce13126f73705b2c677d58cd60d4f6daed17257b5
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_698c57dd543163c21a0d871794682947_amadey_coinminer_elex_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_698c57dd543163c21a0d871794682947_amadey_coinminer_elex_smoke-loader.exe"
    1⤵
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3344
    • C:\Users\Admin\AppData\Local\Temp\2026-10-22_698c57dd543163c21a0d871794682947_amadey_coinminer_elex_smoke-loader.exe.exe
      C:\Users\Admin\AppData\Local\Temp/2026-10-22_698c57dd543163c21a0d871794682947_amadey_coinminer_elex_smoke-loader.exe.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6080
      • C:\Users\Admin\AppData\Local\Temp\2026-10-22_698c57dd543163c21a0d871794682947_amadey_coinminer_elex_smoke-loader.exe.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-10-22_698c57dd543163c21a0d871794682947_amadey_coinminer_elex_smoke-loader.exe.exe" -burn.unelevated BurnPipe.{4753A30A-166C-48E8-9633-2831414ECD7B} {23EE1804-064F-4547-B3A5-58A439206D71} 6080
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1412

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ADelRCP.exe

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
        • Size 859KB
        • SHA256 6205ddb2de6567174b7af57fb5bab74709a364c883d311bf941594eec2cb5833
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wow_helper.exe

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
        • Size 831KB
        • SHA256 a99fad176671bc83347f6a85e37684a4304f7e40631dd93e388d600427740801
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AdobeARMHelper.exe.ico

        • Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe.ico
        • Size 3KB
        • SHA256 2f33dacaebb8bdf6d2d88550cce349c09b51dfeb4f499796f32bd30e14aab86c
        • MD5 SHA1 SHA512 TLSH

        jaureg.exe

        • Path C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
        • Size 1.2MB
        • SHA256 69f59ffcf1ade2b9666dbb811daa4009cd10432f96b7e0efd0100cb70cfa9eab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msinfo32.exe.ico

        • Path C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.ico
        • Size 3KB
        • SHA256 5d7967695bef88a64140c541a09f22b45abe542c2df462d800e72e1d8e121d28
        • MD5 SHA1 SHA512 TLSH

        DisabledGoogleUpdate.exe.ico

        • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.ico
        • Size 3KB
        • SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
        • MD5 SHA1 SHA512 TLSH

        ie_to_edge_stub.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe
        • Size 1.2MB
        • SHA256 cfac9343ff0cbf0fce094790c8864e4f6bd068bef9256eb45df5b66e1767b528
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedgewebview2.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe
        • Size 4.1MB
        • SHA256 97ac45a397699a22a1530c387a4b5884246e89167528b8af91524a6df3607ab5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedgewebview2.exe.ico

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe.ico
        • Size 3KB
        • SHA256 61197ae03a1910353d202dffcc2271af59a9c26150652fbc6a84806cef420176
        • MD5 SHA1 SHA512 TLSH

        pwahelper.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe
        • Size 1.8MB
        • SHA256 70141283aebf3da200a59d0a60db3781b5b9ee914e20343fe9c5cf2d336dd191
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ie_to_edge_stub.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
        • Size 1.2MB
        • SHA256 d29d7a387ca3959b565e36787b3f00b8c690711e29d71bf6ba8782b50ba0e6d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setup.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe
        • Size 7.7MB
        • SHA256 b54a057769a6c5a6df2ed12fee5042b4106c515c6c417a31b310cdab185c7af5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 9fe97b51c173df4cea603b56a1a43ea988da1458a589d5108d0e0f5f95a13f0f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        identity_helper.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe
        • Size 2.1MB
        • SHA256 c0d986f790063c04f93570e7146790311538261b607f34fadc333f888e24ded2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe
        • Size 2.3MB
        • SHA256 68e99354569e58a7203331491b87fd154aeec5d15fd2fa2d8fc7685274c4309d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setup.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe
        • Size 7.5MB
        • SHA256 1721ddfb1ddc8defc09e9e1169682655496d0791efbfb3aa668d57d384ed1f66
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cookie_exporter.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe
        • Size 840KB
        • SHA256 35978c8623ee7c2047f4c946ed9d491f4a4940ff9c33e2537e231ff52657a1fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge_proxy.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe
        • Size 1.9MB
        • SHA256 77fb6657a405d4c29d2939e96b01e29409d6841a4573bf18dc978a9e4967c0a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe
        • Size 4.6MB
        • SHA256 5458f7629df53f3ee30a55e2a03813817e2f6aeb6bcf4a477a5a32e84c28fb99
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge.exe.ico

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.ico
        • Size 3KB
        • SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
        • MD5 SHA1 SHA512 TLSH

        msedge_pwa_launcher.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
        • Size 2.5MB
        • SHA256 4bf5ab2d9d8dd12142d09c283cac88321ff59ccd31ce9e2d4fecd153d7e2011d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedgewebview2.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
        • Size 4.1MB
        • SHA256 44db903794ccae20b421294767e5232556f3a10c2f4c44490b082490d6b2c3e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pwahelper.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe
        • Size 2.1MB
        • SHA256 eb3e5d142eabe7f4bc9f628dd8b027df1385c287880541090e5bb93784171971
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wab.exe.ico

        • Path C:\Program Files (x86)\Windows Mail\wab.exe.ico
        • Size 3KB
        • SHA256 ce19242fbf3efc4fe158fba6ad17e913a57a5fe53166f47dc8e5faa5a9f90a03
        • MD5 SHA1 SHA512 TLSH

        wabmig.exe.ico

        • Path C:\Program Files (x86)\Windows Mail\wabmig.exe.ico
        • Size 3KB
        • SHA256 88c0094fb49858d277e6e56c8c1023bf93356b7d3fc8e037b355d21aa1c7bd34
        • MD5 SHA1 SHA512 TLSH

        ImagingDevices.exe.ico

        • Path C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe.ico
        • Size 3KB
        • SHA256 c76b2392ae75384d2097bd890c529cc5636350476c9a001ee1a055430c8f1c86
        • MD5 SHA1 SHA512 TLSH

        7z.exe.exe

        • Path C:\Program Files\7-Zip\7z.exe.exe
        • Size 720KB
        • SHA256 b47d89e017267b83804105634285ee0e7c3cf45e06869da7c187c05a42d6eeb1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe.ico

        • Path C:\Program Files\7-Zip\7zG.exe.ico
        • Size 3KB
        • SHA256 8cad493433ec34a34ca6f4fd49655aaf7cbb4337752743804db83ea6c050d1fe
        • MD5 SHA1 SHA512 TLSH

        OfficeC2RClient.exe.ico

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.ico
        • Size 3KB
        • SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
        • MD5 SHA1 SHA512 TLSH

        appvcleaner.exe.ico

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.ico
        • Size 3KB
        • SHA256 463b6e99198762de39ea3c9156504527673355f452c17063d0fcc34caa3cfded
        • MD5 SHA1 SHA512 TLSH

        setup.exe.ico

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.ico
        • Size 3KB
        • SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
        • MD5 SHA1 SHA512 TLSH

        ielowutil.exe.ico

        • Path C:\Program Files\Internet Explorer\ielowutil.exe.ico
        • Size 3KB
        • SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
        • MD5 SHA1 SHA512 TLSH

        javaw.exe.ico

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe.ico
        • Size 3KB
        • SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
        • MD5 SHA1 SHA512 TLSH

        CNFNOT32.EXE

        • Path C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE
        • Size 966KB
        • SHA256 62ccfac50310dc0db92a2ccb47c758767117a4fe7fef43883245b55126a7ade8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IEContentService.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
        • Size 1.1MB
        • SHA256 8d71a2a8bf87cd93f47ee0c66d1deb5938d8729e6f925490c43a588c1030a4ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NAMECONTROLSERVER.EXE

        • Path C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE
        • Size 866KB
        • SHA256 23cd03b7e0b79c66239fd59d8b545ace44747353cd3968e874f2c18afd59d3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PPTICO.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.ico
        • Size 3KB
        • SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
        • MD5 SHA1 SHA512 TLSH

        WORDICON.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.ico
        • Size 3KB
        • SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
        • MD5 SHA1 SHA512 TLSH

        excelcnv.exe.ico

        • Path C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.ico
        • Size 3KB
        • SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
        • MD5 SHA1 SHA512 TLSH

        FLTLDR.EXE

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE
        • Size 1.2MB
        • SHA256 f76cc9e2e90188572442888275354ca085a29a9f5341818b1e40feacfd93f282
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MSOICONS.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.ico
        • Size 3KB
        • SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
        • MD5 SHA1 SHA512 TLSH

        MSOXMLED.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.ico
        • Size 3KB
        • SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
        • MD5 SHA1 SHA512 TLSH

        DATABASECOMPARE.EXE

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE
        • Size 914KB
        • SHA256 1b38a80e86539731a57a87e6941863628a653b99400b1d90bf0ec65ce3ad3268
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dbcicons.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe.ico
        • Size 3KB
        • SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
        • MD5 SHA1 SHA512 TLSH

        joticon.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe.ico
        • Size 3KB
        • SHA256 f4c419b2d60ebe6dc173b36b108855b1f4db9c28fda291f4d93ac38e6dd24389
        • MD5 SHA1 SHA512 TLSH

        osmclienticon.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe.ico
        • Size 3KB
        • SHA256 b76444a386ad024bd78ee152f0f6ad2d5dd3b9ed478147014e5d804e7a9e6508
        • MD5 SHA1 SHA512 TLSH

        outicon.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe.ico
        • Size 3KB
        • SHA256 98d0a0fe25fa36309c0bbe62f04a561a1e02d51a4dc2c8331b9b3c2e47387f5f
        • MD5 SHA1 SHA512 TLSH

        helper.exe.ico

        • Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe.ico
        • Size 3KB
        • SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
        • MD5 SHA1 SHA512 TLSH

        updater.exe

        • Path C:\Program Files\Mozilla Firefox\updater.exe
        • Size 1.2MB
        • SHA256 53e8fe6e04fd7b6db49a005d4c6de5d3dc7f7b359573829c648564811bd8cda7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vlc-cache-gen.exe.ico

        • Path C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.ico
        • Size 3KB
        • SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
        • MD5 SHA1 SHA512 TLSH

        MpCopyAccelerator.exe.ico

        • Path C:\Program Files\Windows Defender\MpCopyAccelerator.exe.ico
        • Size 3KB
        • SHA256 02221d573edefa486ba8fe5aee3c8a10c8c7e3188914c0f22df06bb1338db790
        • MD5 SHA1 SHA512 TLSH

        MpDlpCmd.exe.ico

        • Path C:\Program Files\Windows Defender\MpDlpCmd.exe.ico
        • Size 3KB
        • SHA256 9e3f1f8e5166514df44b02a1e0bf7474708dafba161e263cff087af62ba89ae5
        • MD5 SHA1 SHA512 TLSH

        wmpconfig.exe.ico

        • Path C:\Program Files\Windows Media Player\wmpconfig.exe.ico
        • Size 3KB
        • SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
        • MD5 SHA1 SHA512 TLSH

        integrator.exe

        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
        • Size 7.3MB
        • SHA256 f9fb50e1f51c0d0dd5a8f474e713ea104f2fe83b54f02d6cb697a470e56ac9ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcredist_x86.exe

        • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        • Size 1.1MB
        • SHA256 cc491279680561c79c22c01c5008bb172e53c82c8dba4d1d24bebfb7cc4a02a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcredist_x86.exe.ico

        • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe.ico
        • Size 3KB
        • SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
        • MD5 SHA1 SHA512 TLSH

        VC_redist.x86.exe

        • Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        • Size 1.3MB
        • SHA256 18579cc1e057d85588fb7b3e7fe73865ecef30c957aabf6af602ef4aba25f698
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VC_redist.x64.exe

        • Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        • Size 1.3MB
        • SHA256 7fef5b71b7c16a10be565e97536a1f5e71df035eaa7ab56ba2bb2ee549fa5ff7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcredist_x64.exe

        • Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        • Size 1.1MB
        • SHA256 defd749babc28c1dbd488173f8b3cc5722127743b84433bae547a4162b85cc50
        • MD5 SHA1 SHA512 SSDEEP TLSH

        windowsdesktop-runtime-7.0.16-win-x64.exe

        • Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe
        • Size 1.3MB
        • SHA256 f4b0562b6471f305e61f112ef9ec0019d09d51a81f8472f8388cc995523bc72e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneDrive.exe.ico

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe.ico
        • Size 3KB
        • SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
        • MD5 SHA1 SHA512 TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 0bdfa6a8cdaaa61b7f21952c0661bb3df881700d2d6bdaac7ef687ae2c468fba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 e2996d478c63f73065ae88acb851aa7f16b7203693707027fc1267cc586885c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 2561d54e49f86d7c0812e3914c902f0495b830e2c09ad85b37713bd626a8120b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 fd1110ea821c082081d75e05f4aba34c2e4beaccff44df415fd118a76667377d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 e9893780ceea853a8466486f83b08abf8ee8c1c07086febf02871270d6b4af1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 5b7c9dfbd3c45950b454e14773d28d4bc11a46ee032e101a8b3f2a8078ba3c9c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 1d83163e6dcffb06698e327e7e36b5603005a2cc31dbf6aa9ddbccedaff5c0b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 447fe7b7794857e3883d5b79094130cba57ae01fe01015df4d2d7fe082cd59c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 24e3b11120013c85045336e4a3548b0ff17738862172fff1849c9a2391747601
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 135527f8584862b3a501859454d16349131940ebacff7c77b26c2fefe6d6d6ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c46b472dd8e672887cdd1e3eb661cac3553a1623b7e7f01d9d94bbd75c276276
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 20f5b9a0e9a53eae33c3759d168649cb0c32babf1c5c300a76300b9cebe7f44e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 b07a50b114fe87aad9d714d8dafe8d158ff20e5b9c8bed8386100f32c858066a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 9abe72a517a51179cdd705fde746c2ceb5e12e4f45712d7f45b3c5aab67bbf28
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 a8967e263f504897669c889dd71c0d1b4b21d368b3d7b27d3ad55ad69ed65683
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 25549940237f830d18f5f65b88599008925a0b6b4e7b7579795dd27c6786984b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 e7a8f4a7b31b39ea30505016b5516d0d3e5034164f4650f234c915a3f1ddc0e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 dd1e39755cba4a7fb9e07da0c97300e5add31a4daf01ba0a6f76580276c95b56
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 a67c6c1c557de1c8c1c6d73d8d143013f595acfbaa5b51785689ed66a2400932
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 f95843ee3623037999cc831148ce6bb75d0e4dee22d3ece18210a4f7e12f843f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 8e631db08e9e408227305c2826c01b7ece1678e49a8b6fa64d3d1a6a248f2142
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 6cf1606966c7759ef90dbb8cc9726eb5e46ce4b22472591b06a3a23663fd83f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 483468ff161a648748b760827a07651193cec63eb70b08f68f139837e41758e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 9f7ea43c8c8895ef909b5af5a6a0dd21fcac1a578a8339d5437856cb097a3a45
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 d273401dcc2b540a97910c1b989c21996fa0c77a1d7dd53f554b147b8fa2906b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 2d45977b594b0b7e5d719acb6935bee4c500f9dacf6097621ef71e0a33743708
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 92aa6860ed3c85947e5224b11ba5111f121e627dc8d8ae5bb4b7ac72a55930f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 6a6b4b9ca19639ae13c9dc738b9a8a995f4ac939ced88ea61326ecc6c273376f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 802b1cfdeaf95c031c25a40a4f5c699dc46b3f44b5fd106ffa3dc6380a3c22b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 db37a4b4473cd28d8c1ebb53262d8e7544e0814e5fefee5601e1f55fef14f205
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 539e252cb2b5dfa6b3d24303d230040512c05bd0681c0cafd5209e90549f4188
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 5cfa21a3ebd026e68905f1548a6491a7bf3daa5a131ae2808330382dc8017071
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c300643f548204c82a0141b57ffbc053219b55a200480bbe5c74b41965f6e9f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 151f19ca17a98548fe4f5775cbfe0660c726eda3f3a369f906943f047b1ab9ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 413be3afd2aec7c30339a91e3e113a2e0091f42f4866b1a691e031175a57b944
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 507ae0b022a41c1b5c7ef62c2ea696e5ef01b7a2517856b48aa3184f89fb670f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 07cc0f86c467d930071c0be294b94466747267f108e56ad44189cd5315f2fc24
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 07db365ba82d8ce7331d6df42dcbe30993c5020148807b9b7e3a173b4135220e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 706d8fd1e7f861c6c1eb5fcc0114d5be8de8d23abfc025775300ce53c7a09590
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 496faae7a7315a99023bea27a70ac9b4c29198e4462068a9418bc250d3c48986
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 76757833d6638e6dd3a4543a6518395b8f91506bf223aa8bb13de8fe663c6859
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 35fabc1aa5526af3c3453a2ca552c084389d13700571fe316dc5368f24ffb9a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 6b61731761604333343704c2b4269d2ea9e647bf4e3fd48d6644b79aa34df288
        • MD5 SHA1 SHA512 SSDEEP TLSH

        2026-10-22_698c57dd543163c21a0d871794682947_amadey_coinminer_elex_smoke-loader.exe.exe

        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-22_698c57dd543163c21a0d871794682947_amadey_coinminer_elex_smoke-loader.exe.exe
        • Size 460KB
        • SHA256 b6b062b97949e5c9031d1928160dfd806892de84fc4d778446b0d0896a184181
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logo.png

        • Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\logo.png
        • Size 1KB
        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
        • MD5 SHA1 SHA512 TLSH

        wixstdba.dll

        • Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\wixstdba.dll
        • Size 117KB
        • SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/3344-1091-0x0000000000400000-0x00000000004D6000-memory.dmp

        memory/3344-0-0x0000000000400000-0x00000000004D6000-memory.dmp