Overview

overview

7

Static

static

3

2026-08-08...op.exe

windows10-2004-x64

7

2026-08-08...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 18:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
  • Size 3.9MB
  • Sample260808-xe2xesck7x
  • SHA256 110e2ebf672535fcb822675cb3a1bc41bc8ac2e0b0c76051a1b4ea75bb3a0816
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5048
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1747.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5528
      • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:5952
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A54.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:472
          • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2876
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D13.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4680
              • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:5900
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FF2.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3308
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1552
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2205.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2964
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:5296
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2438.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5760
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:916
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a264B.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3656
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:3568
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a285E.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4076
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:5604
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A91.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:3832
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:5244
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C56.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3376
                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:2704
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3109.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:6116
                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:2500
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3937.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4608
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1480
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3ADC.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5024
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4212
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E76.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5784
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1248
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a500A.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1696
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2756
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51C0.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2540
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4204
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5700.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4924
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4852
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58A5.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2300
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5492
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A8A.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5680
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4316
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C4F.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5160
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:860
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E04.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5000
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2928
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EEF.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3404
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2396
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FD9.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3180
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1344
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60A4.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1092
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1992
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a617F.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1544
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1724
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62C7.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5720
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4936
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63C1.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4996
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1152
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64BB.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5624
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5972
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6596.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:628
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4508
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6651.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:3488
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:3668
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a671D.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:2460
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:4512
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6836.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4816
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:5544
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6901.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:2516
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:4568
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69FB.bat
                                                                                                                                          68⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:4412
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2440
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AE5.bat
                                                                                                                                              70⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:5556
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                71⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:5368
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B91.bat
                                                                                                                                                  72⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:5684
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                    73⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:4820
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C6C.bat
                                                                                                                                                      74⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:5116
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                        75⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:108
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D37.bat
                                                                                                                                                          76⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:4088
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                            77⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:1568
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E21.bat
                                                                                                                                                              78⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:4484
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                79⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:3948
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F0C.bat
                                                                                                                                                                  80⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:4872
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    81⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:5324
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FD7.bat
                                                                                                                                                                      82⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:4772
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        83⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:4796
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70D1.bat
                                                                                                                                                                          84⤵
                                                                                                                                                                            PID:2712
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              85⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:3708
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a719C.bat
                                                                                                                                                                                86⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:3320
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                  87⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:2640
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7277.bat
                                                                                                                                                                                    88⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:6096
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      89⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:5676
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7342.bat
                                                                                                                                                                                        90⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4584
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                          91⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:3292
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a742C.bat
                                                                                                                                                                                            92⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:4060
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                              93⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:4728
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74D8.bat
                                                                                                                                                                                                94⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:2372
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:3112
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75A3.bat
                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    PID:4492
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:5992
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a768E.bat
                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:4056
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:4920
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a773A.bat
                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:1144
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:5524
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77F5.bat
                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                  PID:1732
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:3052
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78C0.bat
                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                        PID:5708
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:4140
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a798B.bat
                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:2464
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:1884
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A66.bat
                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:3588
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:4776
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B12.bat
                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:4880
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:2960
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BBE.bat
                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:4664
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:4044
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C89.bat
                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:1096
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:1660
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D54.bat
                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:828
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:5780
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F38.bat
                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:1436
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:3224
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FE4.bat
                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:4888
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:5612
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80A0.bat
                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:3316
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:1136
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a813C.bat
                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:1676
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:6104
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8236.bat
                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:672
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:4860
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82E2.bat
                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                          PID:2764
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:1916
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a837E.bat
                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:5792
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:480
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a842A.bat
                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  PID:5912
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:3860
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84C6.bat
                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:3188
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:3628
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8591.bat
                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:5596
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                              PID:3396
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a862E.bat
                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:2496
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:360
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86F9.bat
                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                      PID:3148
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        141⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:6008
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87B4.bat
                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:3380
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                              PID:5724
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8851.bat
                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:824
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                    PID:1872
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a890C.bat
                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:4392
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:4732
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89B8.bat
                                                                                                                                                                                                                                                                                                                          148⤵
                                                                                                                                                                                                                                                                                                                            PID:1868
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                              149⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:4072
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A45.bat
                                                                                                                                                                                                                                                                                                                                150⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:3796
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  151⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:3100
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AD1.bat
                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:2688
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      PID:2020
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B6D.bat
                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                          PID:4348
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:4156
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BFA.bat
                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:3212
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2888
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C87.bat
                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    PID:6080
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4452
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D61.bat
                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:1132
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            161⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5572
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DEE.bat
                                                                                                                                                                                                                                                                                                                                                                162⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:252
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    163⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    PID:2728
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E8A.bat
                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:2360
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3176
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F27.bat
                                                                                                                                                                                                                                                                                                                                                                            166⤵
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:5600
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                              167⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5392
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FE2.bat
                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:5196
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                    169⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:3420
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a906F.bat
                                                                                                                                                                                                                                                                                                                                                                                      170⤵
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:3096
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:2836
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a913A.bat
                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:4992
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:2340
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91D6.bat
                                                                                                                                                                                                                                                                                                                                                                                              174⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:2428
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9263.bat
                                                                                                                                                                                                                                                                                                                                                                                                    176⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92FF.bat
                                                                                                                                                                                                                                                                                                                                                                                                        178⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          179⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                              180⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2224
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9437.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4288
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9560.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1736
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9689.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9725.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a983F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1280
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98EB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9977.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A04.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A81.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B4C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BD9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C65.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D01.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D7E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E3A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4684
                                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                                            C:\Windows\Logo1_.exe
                                                                                                                            34⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Enumerates connected drives
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5496
                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                                              35⤵
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:5608
                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                36⤵
                                                                                                                                  PID:704
                                                            • C:\Windows\Logo1_.exe
                                                              C:\Windows\Logo1_.exe
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Enumerates connected drives
                                                              • Drops file in Program Files directory
                                                              • Drops file in Windows directory
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4312
                                                              • C:\Windows\SysWOW64\net.exe
                                                                net stop "Kingsoft AntiVirus Service"
                                                                3⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4148
                                                                • C:\Windows\SysWOW64\net1.exe
                                                                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                  4⤵
                                                                    PID:5652

                                                            Network

                                                                  MITRE ATT&CK Enterprise v16

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  $$a1747.bat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a1747.bat
                                                                  • Size 776B
                                                                  • SHA256 0d4a0154c6fe95f79c6463ae7237bf06652363e661188d10b036c38fa403cfbd
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  $$a1A54.bat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a1A54.bat
                                                                  • Size 776B
                                                                  • SHA256 eafb57d0a7700dcf7855f88312a3ca3e221144419ea6002593989437ff41a693
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  $$a1D13.bat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a1D13.bat
                                                                  • Size 776B
                                                                  • SHA256 82b52263125e2ad2ac46125b267c938e39169af10cf8611d840f7dd71430a4cd
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  $$a1FF2.bat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a1FF2.bat
                                                                  • Size 776B
                                                                  • SHA256 7861e39f908046af4aad027e23a4b789b86eaed3c567a9e5f484ea5eb4720f5b
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  $$a2205.bat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a2205.bat
                                                                  • Size 776B
                                                                  • SHA256 5980b9c44df6dcf6c8746fa8befa403b666d4723a4d80084c7fe4a3a6fb7c08d
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  $$a2438.bat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a2438.bat
                                                                  • Size 776B
                                                                  • SHA256 ec0340e013251f0babbb5fc4a59e9bc8e7827c876d804911d2f25948d4e51649
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  $$a264B.bat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a264B.bat
                                                                  • Size 776B
                                                                  • SHA256 c18899fd679d37eba878845579ead1b001665f28d87353728651cb2d6986f726
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  $$a285E.bat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a285E.bat
                                                                  • Size 776B
                                                                  • SHA256 730efede73f0fd7e7a0fb2037940027a7ad88397728cb331a63b032d6d199374
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  $$a2A91.bat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a2A91.bat
                                                                  • Size 776B
                                                                  • SHA256 5a6c8651ca5f04c2025daff79363618ea58114fc2698874e7e22e2cb2c2702a9
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  $$a2C56.bat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a2C56.bat
                                                                  • Size 776B
                                                                  • SHA256 56d40b34b12ce41fde29750d74546bfd5bd103e84c9178f8ca7f7d47bf771df2
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  $$a3937.bat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a3937.bat
                                                                  • Size 776B
                                                                  • SHA256 6d80280c348a558f01c26cee4178fecf6243c10b27f07a05eeee68f0dc891514
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  $$a3ADC.bat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a3ADC.bat
                                                                  • Size 776B
                                                                  • SHA256 3b6aa12394ebf065427c36ea2b920f2b92a89382cd80b94f20da2ca4daa76642
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  $$a3E76.bat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a3E76.bat
                                                                  • Size 776B
                                                                  • SHA256 12451520382445d943b95cccfdac33a044a225b8b148236a0aeaa438682ee425
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  $$a500A.bat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a500A.bat
                                                                  • Size 776B
                                                                  • SHA256 def9f1d88e1fcb45e6b32447791bbeef59bcd769ee951787e68651c9b720315f
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  $$a51C0.bat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a51C0.bat
                                                                  • Size 776B
                                                                  • SHA256 6b04a136274f656c6543d5d77a294ae3fa9bd3d99361820c0e063c23a82777ea
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  $$a5700.bat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a5700.bat
                                                                  • Size 776B
                                                                  • SHA256 e1eac8c1df214e392541f2aef32cea82901e96ddece0c73cafdc387dc4eaf141
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  $$a58A5.bat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a58A5.bat
                                                                  • Size 776B
                                                                  • SHA256 28314b924cf05c4c66cafe280a90d2758d221e8b5959bc4beee321e8c96124d6
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  $$a5A8A.bat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a5A8A.bat
                                                                  • Size 776B
                                                                  • SHA256 7a15bc6883362b2db3df99ce6b6e8bf7401fb04f9e238775274fff8c5ceb0dc0
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  $$a5C4F.bat
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a5C4F.bat
                                                                  • Size 776B
                                                                  • SHA256 d34cc61cecb850780db85c8658f718e4fb4d964c53a5bd683766ffa1fb5824d3
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Size 3.4MB
                                                                  • SHA256 79cadd02f4d54db52776d43a02f0e6890aa6a2a1aaca555b55982aeabbbdace8
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Size 3.3MB
                                                                  • SHA256 aaeb23ea7927ff83911b074ef0aab15b95e4a05dfd0f6c9b2b074bb783856961
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Size 3.3MB
                                                                  • SHA256 f98025436ee3e29831c9e40ddda05713c948a440663b6cbf03c8ce819e8f4d36
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Size 3.4MB
                                                                  • SHA256 e3c9688d1244eee56d90a7ea1f24d251c8414570a6383d06494b7c9264341d11
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Size 3.3MB
                                                                  • SHA256 1b4a2aefdfffb9ecba2b4a118e5221d7009efe728a2be0afdc9f5adeab950c37
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Size 3.3MB
                                                                  • SHA256 5b70b35ba6f1c884dcc724259cdf48537d97425b167ddfe403db5513beb9f168
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Size 3.8MB
                                                                  • SHA256 5b1aed4dc834ad3bfe148760aa6f1a56547e6c4faf94430b9d42bb58c8e851f4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Size 3.8MB
                                                                  • SHA256 611436ef12464f64e1bac1a07239612f981c7cfa667b7f8a47ba77d51727b5b2
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Size 3.4MB
                                                                  • SHA256 1f3e64f6f7004298e72722c9f8f425736828d8f1fa5e74652ec98040006bd0ef
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Size 3.8MB
                                                                  • SHA256 88599b2e1720a9f6d9c06fc78bb3abef1b83ddbd4f23d11a2ac0df180ce11b51
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Size 3.7MB
                                                                  • SHA256 897f84fdb2236b7023c9cf2a3019cdb19ad1962a3e5676bbb3ce40aa83d308fa
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Size 3.7MB
                                                                  • SHA256 1df320454f082bb227eb352edaeacfd0883d58d0d7beda657554411d29d82f62
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Size 3.7MB
                                                                  • SHA256 548f7095d92c0ef6ce1483cf4af85b40db83ad07e2d09877428a90dac05ad7de
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Size 3.6MB
                                                                  • SHA256 c8527f2a0254704145ca4ae204c55b979d660286d7fc1178c7c3dc093b619513
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Size 3.6MB
                                                                  • SHA256 79e6db25ac9691df1cf86f13055ecb9ff52d849881ff99ae5d53806256f2d260
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Size 3.6MB
                                                                  • SHA256 31669de3c39390a2b9962aaa0e1f8e257d7af97fdc1a47813626250c1447b1c0
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Size 3.5MB
                                                                  • SHA256 66c3ad75ecbaa6fa5c5cb6c13431454fdeafe3f3b6386f5a515aa7d77b8a5860
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_b664c662d72ccad78a65874b04d7806f_amadey_elex_smoke-loader_stop.exe.exe
                                                                  • Size 3.5MB
                                                                  • SHA256 737dcdc1dd2e1582203f4c1f81094d59d9dfbc0886e57bcbea58baba8ae8daf3
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Logo1_.exe
                                                                  • Path C:\Windows\Logo1_.exe
                                                                  • Size 32KB
                                                                  • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  _desktop.ini
                                                                  • Path F:\$RECYCLE.BIN\S-1-5-21-3989226554-2204910950-1522900112-1000\_desktop.ini
                                                                  • Size 8B
                                                                  • SHA256 1d606682c3c73b22d9ee6de30be63c56537bbb5179c9016a02f36487fa915852
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  memory/108-6187-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/360-6357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/480-6333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/776-6561-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/860-6101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/916-75-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/1136-6309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/1152-6137-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/1248-5593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/1280-6531-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/1328-6513-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/1344-6116-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/1480-6064-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/1480-1873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/1552-55-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/1568-6192-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/1612-6519-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/1660-6287-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/1724-6126-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/1736-6507-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/1872-6375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/1884-6267-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/1916-6327-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/1992-6121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2020-6399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2072-6525-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2156-6586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2156-6580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2296-6549-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2340-6459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2356-6573-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2396-6111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2440-6172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2500-1865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2580-6465-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2640-6217-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2644-6537-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2704-538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2728-6429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2756-5601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2836-6453-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2876-32-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2888-6411-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2928-6106-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/2960-6277-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/3052-6257-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/3100-6393-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/3112-6237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/3176-6435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/3224-6298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/3292-6227-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/3296-6495-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/3396-6351-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/3420-6447-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/3568-83-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/3628-6345-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/3668-6152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/3708-6212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/3860-6339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/3948-6197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4044-6282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4072-6387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4140-6262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4156-6405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4184-6477-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4204-6066-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4212-2083-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4288-6489-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4312-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4312-6053-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4312-2575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4312-343-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4316-6094-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4352-6555-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4452-6417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4508-6147-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4512-6157-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4568-6167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4728-6232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4732-6381-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4776-6272-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4796-6207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4820-6182-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4852-6076-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4860-6321-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4920-6247-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4936-6132-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/4964-6471-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5048-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5048-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5244-101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5296-63-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5324-6202-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5364-6579-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5368-6177-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5392-6441-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5492-6084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5496-6127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5496-6288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5524-6252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5544-6162-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5572-6423-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5604-93-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5612-6303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5616-6543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5676-6222-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5724-6369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5780-6293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5900-41-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5904-6501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5952-22-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5972-6142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/5992-6242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/6008-6363-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/6020-6483-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/6040-6567-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download

                                                                  memory/6104-6315-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                  Download