Overview

overview

7

Static

static

3

2026-08-12...op.exe

windows10-2004-x64

7

2026-08-12...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/08/2026, 14:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
  • Size 3.2MB
  • Sample260812-ryf66sdc64
  • SHA256 03796aef84db78e5481b5e9da50c0d7ef562c6d82ea43b626bd6176cb2b733b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3740
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF58.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5352
      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2040
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1227.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3408
          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:4616
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1488.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4168
              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:1236
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1718.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1828
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:484
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18AE.bat
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4928
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4696
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A93.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:368
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:2604
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C29.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:5632
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:1520
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DB0.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:1744
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:2668
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F65.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4296
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:5436
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a212A.bat
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:4712
                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:2284
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22D0.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:5652
                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:5276
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24B5.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2728
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2272
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EE6.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5160
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5328
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3128.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4588
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4312
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4404.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5392
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4804
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4869.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4064
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5400
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A3E.bat
                                                                      34⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2484
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5068
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CBF.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2184
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3708
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50C6.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1404
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1300
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a526C.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5032
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3352
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5569.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:6104
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5892
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5683.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1696
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5760
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a578C.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:776
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4392
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6121.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5320
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1532
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61FC.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3392
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1804
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62C7.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4768
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1336
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63D1.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3412
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:6044
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a649C.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2932
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2700
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6567.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2956
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:2692
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6651.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:1380
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4176
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a672C.bat
                                                                                                                              62⤵
                                                                                                                                PID:5172
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4760
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6807.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:4348
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:5664
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68F1.bat
                                                                                                                                        66⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2068
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:3116
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69DC.bat
                                                                                                                                            68⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:2396
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:3724
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AA7.bat
                                                                                                                                                70⤵
                                                                                                                                                  PID:1304
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:1340
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B72.bat
                                                                                                                                                      72⤵
                                                                                                                                                        PID:4676
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:2524
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C6C.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:1740
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:3212
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D47.bat
                                                                                                                                                                76⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:5156
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:4708
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E31.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                      PID:2460
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:200
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F1B.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:2572
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:4816
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FF6.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:3948
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:236
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70D1.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:2448
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:3656
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71BB.bat
                                                                                                                                                                                      86⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:4220
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        87⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        PID:5796
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7296.bat
                                                                                                                                                                                          88⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:2088
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:3156
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7352.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:632
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:5272
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a742C.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:1388
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:5004
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7507.bat
                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:796
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:4460
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7620.bat
                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                            PID:1472
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:6068
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76EB.bat
                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:2996
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:4104
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77A7.bat
                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:4792
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:4052
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7843.bat
                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:4332
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:1324
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a790E.bat
                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            PID:4684
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:2612
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79F9.bat
                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:2304
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:3040
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AE3.bat
                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:4704
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:3364
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B9F.bat
                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                          PID:3004
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:5268
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C79.bat
                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:2508
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:5960
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D54.bat
                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:1028
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:4920
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E4E.bat
                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:5864
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:4236
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8052.bat
                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:5552
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:5304
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a812C.bat
                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:1720
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:1172
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81E8.bat
                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:4828
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:4224
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8294.bat
                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:4288
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:6056
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a834F.bat
                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:5800
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:2736
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83FB.bat
                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:596
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:2928
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84F5.bat
                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:5712
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                      PID:4644
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85B1.bat
                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:1672
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:5912
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a868B.bat
                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:2892
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:2588
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8757.bat
                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                  PID:4232
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:5540
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8831.bat
                                                                                                                                                                                                                                                                                                      138⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:1524
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:5856
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88DD.bat
                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                            PID:1640
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                              141⤵
                                                                                                                                                                                                                                                                                                                PID:4740
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89D7.bat
                                                                                                                                                                                                                                                                                                                  142⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:5096
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    PID:1780
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AC2.bat
                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:4196
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        PID:4940
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B8D.bat
                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:5784
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                              PID:3784
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C58.bat
                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:4356
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:2532
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D23.bat
                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:3292
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      151⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:980
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DCF.bat
                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:6116
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                          153⤵
                                                                                                                                                                                                                                                                                                                                            PID:1896
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E6B.bat
                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:5092
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:772
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F55.bat
                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2860
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                      157⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:3288
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9001.bat
                                                                                                                                                                                                                                                                                                                                                        158⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:2544
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2196
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90BD.bat
                                                                                                                                                                                                                                                                                                                                                              160⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:1976
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                161⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                PID:2552
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9178.bat
                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:3360
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    163⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    PID:6140
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9234.bat
                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:120
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        PID:4860
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a931E.bat
                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:5568
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:2592
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93E9.bat
                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:4924
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:2976
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94A5.bat
                                                                                                                                                                                                                                                                                                                                                                                  170⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:2980
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:1704
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9560.bat
                                                                                                                                                                                                                                                                                                                                                                                      172⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:3268
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        PID:1288
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a963B.bat
                                                                                                                                                                                                                                                                                                                                                                                          174⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:3548
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                            175⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2308
                                  • C:\Windows\Logo1_.exe
                                    C:\Windows\Logo1_.exe
                                    2⤵
                                    • Creates a file in the Startup directory
                                    • Executes dropped EXE
                                    • Enumerates connected drives
                                    • Drops file in Program Files directory
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4344
                                    • C:\Windows\SysWOW64\net.exe
                                      net stop "Kingsoft AntiVirus Service"
                                      3⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2632
                                      • C:\Windows\SysWOW64\net1.exe
                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                        4⤵
                                          PID:2160

                                  Network

                                        MITRE ATT&CK Enterprise v16

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        $$a1227.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1227.bat
                                        • Size 776B
                                        • SHA256 2eb220af1d31a1dcc0ab3103276f741acebbceb68f8d3db093edfc9083af9666
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$a1488.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1488.bat
                                        • Size 776B
                                        • SHA256 82c34c0d1bfbaec08773dd7a0001a2dab5a3b3d99f94bffffbcc64d7191b1a73
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$a1718.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1718.bat
                                        • Size 776B
                                        • SHA256 ef25e4392688760d05cae42fddc02d99d6d865dc8347abd7f131815c4613bda2
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$a18AE.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a18AE.bat
                                        • Size 776B
                                        • SHA256 60244d26ddf428e168df96f543a30b27c75baed736a513eac4076cda5c383497
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$a1A93.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1A93.bat
                                        • Size 776B
                                        • SHA256 cb9a61d4180520e3ded622b95f3a8535cb8ba1af0d11bd17f5796ea4bd665e8e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$a1C29.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1C29.bat
                                        • Size 776B
                                        • SHA256 fedda896ebecd6dc7342f8ae3992666bd91dd789e8cbab2176e1966389b40945
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$a1DB0.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1DB0.bat
                                        • Size 776B
                                        • SHA256 2f2a655808d381bf4f5bcdfd23dd3a266e9e2f804c1186fa2d7764cf2e81a4ba
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$a1F65.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1F65.bat
                                        • Size 776B
                                        • SHA256 b24c34ed6e7f4522b6060cd7bd490e7e4ea0228adf409bba2f0c21dc66fa7cdd
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$a212A.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a212A.bat
                                        • Size 776B
                                        • SHA256 797a72f4b0c87b4af0a0c64522f0a383c3a628fb5a560130b9c0b4a26412f351
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$a22D0.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a22D0.bat
                                        • Size 776B
                                        • SHA256 1bed3fc28260827c11f776275b5d7d530ab48b089c455605c2a6a8fdf109bc9d
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$a24B5.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a24B5.bat
                                        • Size 776B
                                        • SHA256 42d87e99716793057968bfbe21b9c505ddfb9db319e6d1f8dc1ebc340f1634a0
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$a2EE6.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a2EE6.bat
                                        • Size 776B
                                        • SHA256 8a9775dc1ef782d602d950b58b92507af172bdd08e663bd776e08151d1595234
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$a3128.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3128.bat
                                        • Size 776B
                                        • SHA256 fa1639cb780c5928a8395d3e93dca3faf50907b7bd3a30da06461003c0aa9956
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$a4404.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a4404.bat
                                        • Size 776B
                                        • SHA256 e5303f9eef121db7d6f23dac57e3576b354c85f6e0557dd721ca724be0131179
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$a4869.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a4869.bat
                                        • Size 776B
                                        • SHA256 fe1698ff3655521b2ff17a5bebb8910c3b5416f18716f7ac76b347580eba7269
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$a4A3E.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a4A3E.bat
                                        • Size 776B
                                        • SHA256 c85bb58172ad1b060c5b5654f6c23e56bf448eb4feb8bb00c9a6db262939691c
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$a4CBF.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a4CBF.bat
                                        • Size 776B
                                        • SHA256 8b7a3d6175af224e92f59e6ea00d3b1ceb39c7600f49b11e84b0d737e94096f1
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$a50C6.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a50C6.bat
                                        • Size 776B
                                        • SHA256 16ee7a05842d55b870066c6ffae64050e414c3e163fe453153eee171ed68c231
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$a526C.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a526C.bat
                                        • Size 776B
                                        • SHA256 3f6e23947c417679f499f6ef00c5e83501907996bbe985c9a44583b577161dfd
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$a5569.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a5569.bat
                                        • Size 776B
                                        • SHA256 57663cdff272ff3cee22c5d1ede419c5d7c3767c41d637680804bda92b7fde0e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        $$aF58.bat
                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aF58.bat
                                        • Size 775B
                                        • SHA256 5708ef813f4af3fc0dadfcdeb72a7e9ea372fefa0e7f9b5e100bef5484315ecb
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 2.7MB
                                        • SHA256 d6de03604c2cb24cb5cb6181e7e173860c5666b5c7c02a76af4a3b6cb08c4c2c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 2.6MB
                                        • SHA256 1145a2a692a2c84b572a8f5cfc4ff3464b662e98ac068798df093daf505bc3f4
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 2.6MB
                                        • SHA256 f48a8f0b4e07718c95da18cf893ec43b9c8657eb63b1fc1ead7718931135a8ac
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 2.6MB
                                        • SHA256 4269fb24c060a630dbe4afccea31c62f7fafa5a641b33bd4e038c628dba80945
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 2.5MB
                                        • SHA256 ac74c3e91f51b9aa5095cf371b577445d0c79270ed5ba22ea7a6bb685c3d4078
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 3.1MB
                                        • SHA256 4a1bc6baadfd7e35568d02da0fc05dfbd6d5fc9a177221b8b259fe7f9fe0bb2e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 3.1MB
                                        • SHA256 1397746fabb763cf61be7299338647eaf259c1f53c3429a6b14c01ec47213376
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 2.9MB
                                        • SHA256 4fa499c8736a55e8edb5049354bfef36c8545f24e97262805acab432d6f17fe7
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 3.0MB
                                        • SHA256 19923e3a44124978fa80ab3f9091b19d57f100dd51a54252879cb71db9356327
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 3.0MB
                                        • SHA256 45e69f93da6d6eacfb2d05e222f3c9f73de8a4b5ee0a1bc6f52c88e1774b3810
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 2.8MB
                                        • SHA256 952cc7ef11a88d29ed572bfa696661b1a06f3ff6af2751f650764b300aa8a279
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 3.0MB
                                        • SHA256 1e1d4b1968aa738ef3c2a1f1c4ecdb0e9ba3e3cd4340bea3973ed1165080c534
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 2.9MB
                                        • SHA256 4fe97120bc01f613ef137d6fb997137778e76649c9f6629532a02b5f8bf3aad7
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 2.7MB
                                        • SHA256 8df53f5eeb7bec9f49e76aab8e61e46c013b403a45d3bbad81c62f2c606f09ee
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 2.9MB
                                        • SHA256 925077c31a17a002898b98363f0cddf83221f9bba1738f8f7e1a3ea0d20d53dd
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 2.7MB
                                        • SHA256 e4b9a8d69d636bc56f9b690366b5616f43f14cdaccc4cd5fd97c0bc3c0e7c50a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 2.8MB
                                        • SHA256 b000571feb92f79611733257b97baadd52a49448918113ea233632c696fe8d73
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 2.8MB
                                        • SHA256 f43fcdd228e69d3107c81549dbb4ca9880087d229e022639c0e442e703462d58
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 3.2MB
                                        • SHA256 6df216c46b1f66f6700d9413e2edea2f80e8b41146680961444826a36e9e7173
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_668eaff96f0adab05f430f7915377842_amadey_elex_smoke-loader_stop.exe.exe
                                        • Size 3.1MB
                                        • SHA256 cab875cfef2395d0649e7152b9e51467f0e9b7f8c21ce859aea992a0d5c91538
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        Logo1_.exe
                                        • Path C:\Windows\Logo1_.exe
                                        • Size 32KB
                                        • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        _desktop.ini
                                        • Path F:\$RECYCLE.BIN\S-1-5-21-3986082593-3624157295-3514260330-1000\_desktop.ini
                                        • Size 9B
                                        • SHA256 795373f55aa8008b942f6ca767101aa901068f68d1792d864966ee4353af953d
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        memory/200-8195-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/236-8205-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/484-1877-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/484-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/772-8397-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/980-8389-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/1172-8300-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/1236-42-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/1288-8452-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/1288-8446-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/1300-6104-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/1324-8255-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/1336-8128-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/1340-8175-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/1520-2786-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/1520-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/1532-8118-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/1704-8445-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/1780-8365-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/1804-8123-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/1896-8391-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/2040-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/2196-8409-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/2272-1882-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/2284-111-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/2524-8180-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/2532-8383-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/2552-8415-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/2588-8341-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/2592-8433-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/2604-72-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/2612-8260-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/2668-92-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/2692-8145-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/2700-8140-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/2736-8316-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/2928-8323-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/2976-8439-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/3040-8265-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/3116-8165-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/3156-8220-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/3212-8185-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/3288-8403-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/3352-6116-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/3364-8270-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/3656-8210-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/3708-6096-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/3724-8170-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/3740-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/3740-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/3784-8377-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4052-8250-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4104-8245-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4176-8150-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4224-8305-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4236-8290-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4312-5096-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4344-2777-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4344-7803-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4344-106-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4344-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4392-8113-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4460-8235-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4616-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4644-8329-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4696-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4708-8190-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4740-8359-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4760-8155-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4804-7807-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4804-5611-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4816-8200-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4860-8427-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4920-8285-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/4940-8371-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/5004-8230-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/5068-5716-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/5268-8275-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/5272-8225-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/5276-145-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/5304-8295-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/5328-1890-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/5400-5619-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/5436-102-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/5540-8347-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/5664-8160-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/5760-6127-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/5796-8215-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/5856-8353-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/5892-6122-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/5912-8335-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/5960-8280-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/6044-8135-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/6056-8310-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/6068-8240-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download

                                        memory/6140-8421-0x0000000000400000-0x0000000000445000-memory.dmp
                                        Download