Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/11/2026, 02:02

General

  • Target
    2026-11-12_5ec566eb5e50c6b42c0b12d3562e0c4d_amadey_coinminer_elex_smoke-loader.exe
  • Size 1.1MB
  • Sample261113-cf8fdaex4t
  • SHA256 37cbcf11f6d8c1df34d5822973e8b574da64168bc54ab7829347772a7cfb41ae
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-12_5ec566eb5e50c6b42c0b12d3562e0c4d_amadey_coinminer_elex_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-12_5ec566eb5e50c6b42c0b12d3562e0c4d_amadey_coinminer_elex_smoke-loader.exe"
    1⤵
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4672
    • C:\Users\Admin\AppData\Local\Temp\2026-11-12_5ec566eb5e50c6b42c0b12d3562e0c4d_amadey_coinminer_elex_smoke-loader.exe.exe
      C:\Users\Admin\AppData\Local\Temp/2026-11-12_5ec566eb5e50c6b42c0b12d3562e0c4d_amadey_coinminer_elex_smoke-loader.exe.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4764
      • C:\Users\Admin\AppData\Local\Temp\2026-11-12_5ec566eb5e50c6b42c0b12d3562e0c4d_amadey_coinminer_elex_smoke-loader.exe.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-11-12_5ec566eb5e50c6b42c0b12d3562e0c4d_amadey_coinminer_elex_smoke-loader.exe.exe" -burn.unelevated BurnPipe.{18BFA8D1-804A-43D9-B1F8-9EAEECB62A30} {0C6595CF-39DC-40EE-9C81-525514915AE9} 4764
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4640

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AcroLayoutRecognizer.exe

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe
        • Size 732KB
        • SHA256 347daef12013be039a469d43b5dc2c3272696da8b45b8290a1cf051ee4f884bc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LogTransport2.exe

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
        • Size 1.0MB
        • SHA256 ac033160bd355c8e6c67cc2737b9c88f57f613211755924f819f0a252ac38457
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AdobeARM.exe

        • Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
        • Size 1.8MB
        • SHA256 61704786b62cb4d70edf4d1f1f9edaba2a5b12b4c11148357b68770966ba3da9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AdobeARMHelper.exe

        • Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
        • Size 1.1MB
        • SHA256 8813d0634b58fd9cae991e2763c3687b2626d0ea1e27d23d687b1502eb7202a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AdobeARMHelper.exe.ico

        • Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe.ico
        • Size 3KB
        • SHA256 2f33dacaebb8bdf6d2d88550cce349c09b51dfeb4f499796f32bd30e14aab86c
        • MD5 SHA1 SHA512 TLSH

        msinfo32.exe.ico

        • Path C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.ico
        • Size 3KB
        • SHA256 5d7967695bef88a64140c541a09f22b45abe542c2df462d800e72e1d8e121d28
        • MD5 SHA1 SHA512 TLSH

        javaw.exe

        • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaw.exe
        • Size 1005KB
        • SHA256 b70d79974f0ea6f19becaf3801181e9e0f565296eddf1c36656889638ec316b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DisabledGoogleUpdate.exe.ico

        • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.ico
        • Size 3KB
        • SHA256 2e039a7ce5af3783a3d522d27112bfe7a1dac319ed5061de3bef89790d5ad63e
        • MD5 SHA1 SHA512 TLSH

        msedge_proxy.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
        • Size 1.8MB
        • SHA256 6e5348a8bde934bb48e9506afa48358df6cfc617355f4efb8de943c70858fe4e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedgewebview2.exe.ico

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe.ico
        • Size 3KB
        • SHA256 61197ae03a1910353d202dffcc2271af59a9c26150652fbc6a84806cef420176
        • MD5 SHA1 SHA512 TLSH

        pwahelper.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
        • Size 1.7MB
        • SHA256 3a37f9fee6f1fa00d05840d0a8482d811b578b56857e22a4c9fc265f5bb33744
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
        • Size 4.6MB
        • SHA256 6284475c0a1689d3e848d05badfd0879a1c56920ee5d2dda267eb9035aa0470b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cookie_exporter.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe
        • Size 841KB
        • SHA256 6c6108622d746cb227175eae243b956853ef4ddab0348c02e62a730fe9216193
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe
        • Size 2.5MB
        • SHA256 eac8c17a611d2129fcdddb9e459a2b7c4efb726cd789bb43f8a1d0aa8b7dd7e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setup.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        • Size 7.7MB
        • SHA256 d8bedb064b1521cd7eabfa3fbb0ddc26990a029383299e4db3455feba8bff9f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge_proxy.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
        • Size 2.1MB
        • SHA256 feb7013e26b20bbd9560a4b6f890727a734f827026e069ff9c4a314c11991e19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge_pwa_launcher.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
        • Size 2.5MB
        • SHA256 aad4476cf398c4bcaa228f44c5aa0105568bb6dde54fe99b6666624e774f516f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge_pwa_launcher.exe.ico

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe.ico
        • Size 3KB
        • SHA256 4785d266a2c476e0948100ea80f927d16389f7718b540daf0488457ba01958b0
        • MD5 SHA1 SHA512 TLSH

        notification_helper.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
        • Size 2.3MB
        • SHA256 ba57931bdb7e9260ce49309475bec00b59e40e86ea026d70ef9f2a3782afc0d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msedge_proxy.exe

        • Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
        • Size 2.1MB
        • SHA256 63d93fd60de5c505c08495ad5b4dd6b4f50a447b2905ffa13dffeb6953330bec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        maintenanceservice.exe

        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 992KB
        • SHA256 194e6cdfc54b6fdd960221d5e1eb613fe8d541bf4bab8e915c75d3e09958df41
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wab.exe.ico

        • Path C:\Program Files (x86)\Windows Mail\wab.exe.ico
        • Size 3KB
        • SHA256 ce19242fbf3efc4fe158fba6ad17e913a57a5fe53166f47dc8e5faa5a9f90a03
        • MD5 SHA1 SHA512 TLSH

        wabmig.exe.ico

        • Path C:\Program Files (x86)\Windows Mail\wabmig.exe.ico
        • Size 3KB
        • SHA256 88c0094fb49858d277e6e56c8c1023bf93356b7d3fc8e037b355d21aa1c7bd34
        • MD5 SHA1 SHA512 TLSH

        wordpad.exe.ico

        • Path C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe.ico
        • Size 3KB
        • SHA256 9948a7a97643b62f3496c08d5c06563d78e1a2eb7955a508cab6ccab402b33fd
        • MD5 SHA1 SHA512 TLSH

        ImagingDevices.exe.ico

        • Path C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe.ico
        • Size 3KB
        • SHA256 c76b2392ae75384d2097bd890c529cc5636350476c9a001ee1a055430c8f1c86
        • MD5 SHA1 SHA512 TLSH

        7z.exe.exe

        • Path C:\Program Files\7-Zip\7z.exe.exe
        • Size 716KB
        • SHA256 04d6ae8d890af8d24136bf24932e53ec1f05786597ac4998027956eb08802444
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe.ico

        • Path C:\Program Files\7-Zip\7zG.exe.ico
        • Size 3KB
        • SHA256 8cad493433ec34a34ca6f4fd49655aaf7cbb4337752743804db83ea6c050d1fe
        • MD5 SHA1 SHA512 TLSH

        OfficeC2RClient.exe.ico

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.ico
        • Size 3KB
        • SHA256 19306f3f899e8bae15a744924f1ebf2ce88624f5dd297e3993645fe8453adaa9
        • MD5 SHA1 SHA512 TLSH

        appvcleaner.exe.ico

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.ico
        • Size 3KB
        • SHA256 2a5c5c2bc95c18eded222f0a38752717c1a6ad20e31bcda6472bbba77ed22fe4
        • MD5 SHA1 SHA512 TLSH

        setup.exe.ico

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.ico
        • Size 3KB
        • SHA256 3d275500cf3ebda5e878d81dcbbaa53528397ccbe631aae8fae60de1ffefccf7
        • MD5 SHA1 SHA512 TLSH

        ielowutil.exe.ico

        • Path C:\Program Files\Internet Explorer\ielowutil.exe.ico
        • Size 3KB
        • SHA256 dd8074940b2a1e8d0ad513e7c6e2a0d0b11a857893f11dc77387800ca272e970
        • MD5 SHA1 SHA512 TLSH

        javaw.exe.ico

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe.ico
        • Size 3KB
        • SHA256 6c3d33a5119708abbf19b802f0908183037cd57a6394e45b7b234a76ef4b46c5
        • MD5 SHA1 SHA512 TLSH

        Integrator.exe

        • Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
        • Size 7.3MB
        • SHA256 4468c73db3bb7077fe9c790642f378ebad524954170c80aa552823309db07460
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PPTICO.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.ico
        • Size 3KB
        • SHA256 3b07d1aaa1c9c27082d7811d694aae3d422d5d965a91b2d4b8ecda3a79f760a2
        • MD5 SHA1 SHA512 TLSH

        SKYPESERVER.EXE

        • Path C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE
        • Size 831KB
        • SHA256 4b5b66b73471c27be34b107c417b0e01bd21faac9ecea8a3089ea627a7f7eed7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WORDICON.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.ico
        • Size 3KB
        • SHA256 5bd706a18e0cf54197df7f1d5239f3e058652bfde372afcab230ee9b95ba14a5
        • MD5 SHA1 SHA512 TLSH

        excelcnv.exe.ico

        • Path C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.ico
        • Size 3KB
        • SHA256 6454633b8c6a69aad48c3fc556c5e81cb5362db0c449b3f543bddfa41eba8d6b
        • MD5 SHA1 SHA512 TLSH

        MSOICONS.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE.ico
        • Size 3KB
        • SHA256 df2cca9b322f9432b3f3aa7b91a12dd5f22fd50e589e3107e066d99bdb071176
        • MD5 SHA1 SHA512 TLSH

        MSOXMLED.EXE.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.ico
        • Size 3KB
        • SHA256 063c8f44d23e1ebbe390ea320eee672c449f47333120b7abbd4a78094c613113
        • MD5 SHA1 SHA512 TLSH

        Common.DBConnection.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe
        • Size 767KB
        • SHA256 a4b3c1337b9412e52e5f22a87b978a5925078397b11b3acf2fd502995baa2553
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dbcicons.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe.ico
        • Size 3KB
        • SHA256 b2a350ffac5074add67fe974467351777915de5a319be7879ba15d1f6915a092
        • MD5 SHA1 SHA512 TLSH

        joticon.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe.ico
        • Size 3KB
        • SHA256 f4c419b2d60ebe6dc173b36b108855b1f4db9c28fda291f4d93ac38e6dd24389
        • MD5 SHA1 SHA512 TLSH

        osmclienticon.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe.ico
        • Size 3KB
        • SHA256 b76444a386ad024bd78ee152f0f6ad2d5dd3b9ed478147014e5d804e7a9e6508
        • MD5 SHA1 SHA512 TLSH

        outicon.exe.ico

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe.ico
        • Size 3KB
        • SHA256 98d0a0fe25fa36309c0bbe62f04a561a1e02d51a4dc2c8331b9b3c2e47387f5f
        • MD5 SHA1 SHA512 TLSH

        crashreporter.exe

        • Path C:\Program Files\Mozilla Firefox\crashreporter.exe
        • Size 4.1MB
        • SHA256 8bf5f0e8518cbd3a96b8779386a820dbdbe2d80e5875adc5d8f735659e35113c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pingsender.exe

        • Path C:\Program Files\Mozilla Firefox\pingsender.exe
        • Size 803KB
        • SHA256 d1c889de0817ae8b08bc9b651643e7d9b9a34672b3f9e1128d8b10f490dc0dd2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        helper.exe.ico

        • Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe.ico
        • Size 3KB
        • SHA256 44ae793c391e8578709e181e83cb820caaa10c08844440885d969a6c839b8a2b
        • MD5 SHA1 SHA512 TLSH

        vlc-cache-gen.exe.ico

        • Path C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.ico
        • Size 3KB
        • SHA256 3b17b29b6c4e39fc36571f8e0795eae6559637529602ae7a37d5f8f6254d0500
        • MD5 SHA1 SHA512 TLSH

        wmpconfig.exe.ico

        • Path C:\Program Files\Windows Media Player\wmpconfig.exe.ico
        • Size 3KB
        • SHA256 a32208cf5c16d7223999e6ecf1c185bc88d519483ff56ad5ca5f2cc00e677307
        • MD5 SHA1 SHA512 TLSH

        integrator.exe

        • Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
        • Size 7.3MB
        • SHA256 9d358c5457e14ec45e4c2abd41df2f80ebb50577f01ab23362acbe53a4f7089f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcredist_x86.exe

        • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        • Size 1.1MB
        • SHA256 3c0a3c3e827b4d449c0236eeccd17dbf8a1f476788a4acfc13848e146f2608fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcredist_x86.exe.ico

        • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe.ico
        • Size 3KB
        • SHA256 6ed1664d7718a68084ea1a4abb1d9621a6ae8da8e19db35cfca13aaa4c05eb33
        • MD5 SHA1 SHA512 TLSH

        VC_redist.x86.exe

        • Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        • Size 1.3MB
        • SHA256 59f381ac778e33e9227d8631e8ae568fbde8dffb5ae59cef4ec2c999463db3a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        windowsdesktop-runtime-8.0.15-win-x64.exe

        • Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
        • Size 1.3MB
        • SHA256 0e870af2145584ce14fa42e3a9a78983344db027e1950decc6fcb26b012eea9b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VC_redist.x64.exe

        • Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        • Size 1.3MB
        • SHA256 fe9bc185c180032abb5e3d485adb0ffd4764e6e102a3ad6b3be84626f7971c8e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        windowsdesktop-runtime-6.0.27-win-x64.exe

        • Path C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
        • Size 1.3MB
        • SHA256 f17372dd89ec115f129b1a33dde1868630532692048580317e2657d3fefac592
        • MD5 SHA1 SHA512 SSDEEP TLSH

        windowsdesktop-runtime-7.0.16-win-x64.exe

        • Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe
        • Size 1.3MB
        • SHA256 3e8a442d15feecfcab31fa61ec17f0fe45733270bb6a7470da4f5ba4a906b9ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcredist_x64.exe

        • Path C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
        • Size 1.1MB
        • SHA256 0c61ebccc709c690cb447c97638c47fc953e267fa79cd4caf3be67f0e515d838
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FileCoAuth.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
        • Size 1.2MB
        • SHA256 fa9b3b3cf2b8b877eef82e0ad23499de0419da437ef39b132b0a3d5e514f430e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneDriveSetup.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
        • Size 27.3MB
        • SHA256 bf2f5d92b54f50c43a3c55f036e6693b7b18c57fa5bfb1eba48a2e5632998014
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneDrive.exe.ico

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe.ico
        • Size 3KB
        • SHA256 3a2d7fd9799178af58fbd08a2fffc56398cbf289c7ddd5c5f0fb2e241395261e
        • MD5 SHA1 SHA512 TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 0cad61d8d8584c24026143336fdb8ce497107ce370b935647919dee00b349970
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 5f72881dee9605e023051546b8ccef75716c485f7d8f9bb460233cd6d2187e4e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 5524896abcfc6df2d43bef9eefe6886126d09b351dc05d6106fba3f88ad165d4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 0806640700a92e732ee5d00aa85e9e0fe738acf36cb2023a96d066fa22535ff6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 7ff21c8ee1a01c3006cc9c2c8e0f081672333409c56ca6b40c1cb7e3223bd0d7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 ad5e492011712ec8e837f774a45bc44940b96c155a8d3b567bcd849fbd9b4d65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 4ab52659177ad140606d0d44e169009c412c42a82fc91883609263f8f71d68af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 7217836a355464b5d40c8c00d670783fc7ff938086480ff68d939f75d494a3b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 15bcd3855aec5418b88f338a98348fb1a1365b57900d3210cbf4a51799f86df5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 133de66810d8a5cd25b5d158fccf7f938f775c9cdfcc287e03cd1f2e9ee1a34f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c25ab3f5fa37e9444a416fb90c333547afdb1c367bc881b7a5a15365c4e7f8bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 e1367c3aba319ad5a0d0bb3e5bedb065820e9ba3d74bd846e6424cb647e12207
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 1a5a6cfb14e6e043362f7711d6ce72df7cb838257093d0b4499b3b678e2a615b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 7e37b5b8abe700d6c86e5ce08e45b5b9cf74abb780219bde4ce4f245ab06101f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 6ede777c509bee2e532304f469ecdcd5884230d3b41159ba771d7967265ef5ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 7dabc0a396c74379d1b1fd9a8c414a479ade792180816be36bc3c9c2e5fc48b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 4f6cc97cc7cc13dc4cb07e6165fb80c3e05723d37c4fb55c28a7421ee9ddf14f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c10545c043968e61cea8f1560d900c8f598ffa6e8fcd7aee7357fe373c581ddb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 4fabe075c5437b8cbbd9cf0f66a457e014c7a74b46d24e0dcb7ff461a682924e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 e1a3a8832a30b6d351d8296a9e872e6fa15c9ef8cb8b8409e7060267ecf29038
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 aa81126fbd76da98231148de7fef179062451f67abbbff442ca3511f0ee689a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 7392417866645a1f26ff5d7c385c4857c0614033f153ac2d9df2f03c940ca677
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 12ed2048f7148f7fc3a7b0900bd02d4d3e41664c27c45af4214742d80ba5eb4d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 9f00e97c95c0b80dbfa787c23bf954b421ebb041302b7878b0bbca3caf9e4ee6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 8bc38690b6406ad51c33f2fad89d86a3aed7ec6d3781829dc1d08d8742bf31df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 43852a74f64d9d3d4d3cdf812ccada133255abe925074401ba2ee3a29511608f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 9eeddd5bf7752f7758efd669f9a5525f62aee398e399f0ada4a7122c9c8df60d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 1e1a2e4423df7f76f226a6f8531077124008e7571f1674e7ddbe13f4f4607afe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 3ccc59b92e5dd9557262881dd1d6465af2eae1e6e992ffa8a06468376f227937
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 b0c9f74cb7831f7cf09e10863a03b7712a29814652d19db16f6270dda8f2d34d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c2a5c048047d4a2d9db04d18bccb1afb1a8d2adcdf3f6f4ef318cd7f742c639b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 c1735a99e0f7506a4b6e7d1ff011d33d9a112d1801957890f2dab008da4764e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 cd5c5233382b11ea7d11cc4a64455b262f08ed6177709f2a6229a1906348518b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 3a56864cf994bfe4448fba575dba39badabf1b45164a2dbd099516672408433d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 7c90f2b4cfd1f27ae077781f9098f8faabbab60dfab63aa8b7c52d2d28c79616
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_idx.db

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
        • Size 56KB
        • SHA256 485fffa87493d14afcaf9519779c140281e5b8f0958221070ed86560ef0ed398
        • MD5 SHA1 SHA512 SSDEEP TLSH

        2026-11-12_5ec566eb5e50c6b42c0b12d3562e0c4d_amadey_coinminer_elex_smoke-loader.exe.exe

        • Path C:\Users\Admin\AppData\Local\Temp\2026-11-12_5ec566eb5e50c6b42c0b12d3562e0c4d_amadey_coinminer_elex_smoke-loader.exe.exe
        • Size 1.2MB
        • SHA256 e67d509014a2b783ac16edcbc8e0db3a696e78fbbc74055e4b8c735078f34ebc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        2026-11-12_5ec566eb5e50c6b42c0b12d3562e0c4d_amadey_coinminer_elex_smoke-loader.exe.exe

        • Path C:\Users\Admin\AppData\Local\Temp\2026-11-12_5ec566eb5e50c6b42c0b12d3562e0c4d_amadey_coinminer_elex_smoke-loader.exe.exe
        • Size 460KB
        • SHA256 67ef8287938e4c3771037ef8ad91dcfdafe33f90237617fb60954bda32545c4f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logo.png

        • Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\logo.png
        • Size 1KB
        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
        • MD5 SHA1 SHA512 TLSH

        wixstdba.dll

        • Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\wixstdba.dll
        • Size 117KB
        • SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SuspendLock.exe

        • Path C:\Users\Admin\AppData\Roaming\InitializeWrite\SuspendLock.exe
        • Size 1.4MB
        • SHA256 fd6e2b4034a91ba85b4058d9bf27b2f27b36f2bc8725c7f106b9dcab5f56c76a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/4672-0-0x0000000000400000-0x00000000004D5000-memory.dmp

        memory/4672-1225-0x0000000000400000-0x00000000004D5000-memory.dmp