Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 17:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe
- Size 399KB
- Sample260423-vm8ntsb12x
- SHA256 f2bcb97af36922282a947864055f64939f52014682b2a4e54cbed3b58d0d6c10
- MD5 ae1cdc88e3c0501f9040681c3ef75f6e
- SHA1 310069f9b7d470e892b8dc4486b3a477404f862d
- SHA512 b4b8b932da245fe90676506aa0e5b1a10d59dd8f31d0d8bc40909c44d4b995762bc21231b3439067974bdf9c06e45acb61602dd0c2fda863627916539790a471
- SSDEEP 6144:6j9jU4TvLRdd1+vsZ/c2++hdP6E/FY4TQAEXXLgRHe0r7e4F2rneqB3E4t:6j1rFb1+b2NFYAEXX4e0ne4F2rnXt
- TLSH T1EB9419127BF98435F2F36B319D7582714A77BC61AD38C20E2390262D9EB1A90DA74737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1944 Logo1_.exe 1560 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\es_MX\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Internet Explorer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\default_apps\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\management\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\security\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_w1\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\XLSTART\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\Updates\Apply\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\rundl132.exe 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe File created C:\Windows\Logo1_.exe 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe - Program crash 2 IoCs
pid pid_target Process procid_target 1268 1944 WerFault.exe 80 4264 1944 WerFault.exe 80 - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe 1944 Logo1_.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1560 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1560 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 1560 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1160 wrote to memory of 4288 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 79 PID 1160 wrote to memory of 1944 1160 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 80 PID 1944 wrote to memory of 892 1944 Logo1_.exe 82 PID 892 wrote to memory of 2808 892 net.exe 84 PID 4288 wrote to memory of 1560 4288 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1560
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2808
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 7923⤵
- Program crash
PID:1268
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 7923⤵
- Program crash
PID:4264
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1944 -ip 19441⤵PID:3676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1944 -ip 19441⤵PID:712
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.1MB
- SHA256 c08729fc500930b5e8107a0f8ebaff164f26aa2e264ef5270dc185512db7bc7d
- MD5 8e9e0b8928b4eefcc47f5ead02730eac
- SHA1 acfa7de5d073c0a06a9d26f815a58c15bb55352d
- SHA512 b6ad05a274e5eba5c70ad06bf7d4b7ca686e0bfb467181d3fb36987399e7bed5b4ab60308c9fc96e740ec16137c7331ab4c6af1146565464cb5160f553ccfff9
- SSDEEP 49152:AGj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMi4FqJLd237:AVQRQyi36YOcP+Lvw2gAf+PN34
- TLSH T177566B13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a2A.bat
- Size 774B
- SHA256 aa6091ef366e3778512f92a1ab5856f57a3a1bf9941ddceaa5490f18a1db6987
- MD5 247a88676f97c8278663e0fb74a741d7
- SHA1 32ef76d62b1c6857c401255c65fd5a588ad43aa9
- SHA512 31d3af51aac17bc8542356411af3fa0f5fe5a02daaa3091edf8381d726edae6ce95a0d81bf11109e7fd39e981ef15662d7c9b47fd4920b85f22cdc5ee58e49a8
- TLSH T1E5015E1242BB9D7E0A00A01F8FB15D8F83DD2AC97A513736B396E3AD41C008AF5E6247
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe.exe
- Size 355KB
- SHA256 c22b54d7f91795b06d8f1e8f712befcd37c45e5bfd47e7224093c6b34dd760da
- MD5 0b04bce32b624d32fa3e8db79ce316e1
- SHA1 d6f8fff4f35baaed22107767e9e01cb133079dca
- SHA512 7d6396aaf4b03d36415f5639c7441e2e99b41b3c5ff8d99e559185046a92772002aed6d0b871da584e4c015396514f30f3895bf3e3c124375806d9656d84f6e1
- SSDEEP 6144:7d1+vsZ/c2++hdP6E/FY4TQAEXXLgRHe0r7e4F2rneqB3E4t:Z1+b2NFYAEXX4e0ne4F2rnXt
- TLSH T19074191277F58435F6F32B31AD7582714A7BBC61AD38C20E2390262D9EB1A90DA74737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 44KB
- SHA256 db6a443785d113c28a06566cb990aabc13b069a3b72bb47e811c06bfd80f021b
- MD5 d34c8df725ec27444cc98c0748a9b32e
- SHA1 1202b86671642ece3ffe5ba2f9d8b8f357114779
- SHA512 7d306e2c83efe10af71ca35f5f1340a6a447643df47694547052ea116d2039184f56f9803cefd2a1af5e183128fc1a7c4b96e81557bca1f031de99d39f8f28cf
- SSDEEP 768:hYOT2ljlL5b+/ScqpLTQZBd+vry+1oUEKtBF5fn3ZTJAzONE1d05JyA:6tj95b+lcTQ7d+XoGhv3dJKOY8MA
- TLSH T18D13EF178F0E4AA4D0D1D13426EB0F85D630AC40B421DA1997E0784DDFF2B95FE4AAAF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\$RECYCLE.BIN\S-1-5-21-3119821332-640943685-2562343641-1000\_desktop.ini
- Size 9B
- SHA256 de3322e1c49dc0b70d2b3a63a9ce062799d4a9d96851d3532ae97dadd8aa2da4
- MD5 de22c088d086e709e318b73d582b66d5
- SHA1 21b0cea79c0be404e5650d5b3fa75a4de34f1d34
- SHA512 c194c24781379e329ee96697c961c80fd6c0483c5f9ac66634e5c8ed5bbdf20c3c5a201fc10a784fdbb9b43a6d4c948415c92f2986ed229d8466d97523645894
- MD5 SHA1 SHA512