Overview

overview

7

Static

static

3

2026-08-27...op.exe

windows10-2004-x64

7

2026-08-27...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/08/2026, 18:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
  • Size 2.3MB
  • Sample260827-xgdbvazelg
  • SHA256 1e63289b679a5868f2cc74e47e3bbee0e24e32ffcb7c9b8483cb53075d43e97b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 61 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 63 IoCs
  • Executes a command shell one-liner 1 TTPs 60 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2040.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:816
      • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3636
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a233E.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4460
          • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1992
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a260C.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1224
              • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5528
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27C2.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2304
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:260
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28EB.bat
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:5372
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:5872
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A42.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:4452
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:2788
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B4C.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:5128
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:432
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C75.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:5756
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:2604
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D8E.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:5064
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:3032
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2ED6.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:3400
                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:4248
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a301E.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:1920
                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:1080
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3167.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3244
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1004
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3280.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1860
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2972
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3389.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5092
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2260
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34D2.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4244
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2852
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B0B.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1420
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4052
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F70.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4712
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4140
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a405B.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:6068
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4200
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4164.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2256
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1440
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44CF.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5584
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3316
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5421.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4808
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1892
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a551B.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4364
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3012
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55E6.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2440
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2796
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5683.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3732
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5856
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a573E.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:5332
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3740
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5971.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2700
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3540
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A3C.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2936
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4472
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AD8.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5852
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3056
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BA3.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2384
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4928
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C5F.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4740
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5984
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CFB.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4428
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:1764
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DD6.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:5560
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:2368
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E62.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:5748
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2436
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EFE.bat
                                                                                                                                          68⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:3860
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:620
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FAA.bat
                                                                                                                                              70⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:4288
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                71⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:2408
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6066.bat
                                                                                                                                                  72⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:6036
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                    73⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:4776
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6102.bat
                                                                                                                                                      74⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:6012
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                        75⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:5216
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6901.bat
                                                                                                                                                          76⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:5916
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                            77⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:2496
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a698E.bat
                                                                                                                                                              78⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:3568
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                79⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:5468
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A49.bat
                                                                                                                                                                  80⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:4564
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    81⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:5304
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B05.bat
                                                                                                                                                                      82⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:1524
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        83⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:1872
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BB0.bat
                                                                                                                                                                          84⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:5360
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            85⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:4116
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C7C.bat
                                                                                                                                                                              86⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:4280
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                87⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:4672
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CF9.bat
                                                                                                                                                                                  88⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:1480
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    89⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:2808
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DA4.bat
                                                                                                                                                                                      90⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:4276
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        91⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        PID:5816
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E31.bat
                                                                                                                                                                                          92⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:4264
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            93⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:4572
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EDD.bat
                                                                                                                                                                                              94⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:2816
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                95⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:548
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F79.bat
                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:3564
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:2192
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7025.bat
                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:3020
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:4196
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a710F.bat
                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:4068
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:4080
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71AC.bat
                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:5496
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:3892
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7258.bat
                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:1488
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:3668
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7313.bat
                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:4664
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:4216
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73BF.bat
                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:2712
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:4552
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74A9.bat
                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:5472
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:2500
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7555.bat
                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:1772
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:5788
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7611.bat
                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:1140
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:6008
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76BD.bat
                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:5556
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:1268
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7797.bat
                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:5316
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:4544
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7834.bat
                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:2968
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:1068
    • C:\Windows\Logo1_.exe
      C:\Windows\Logo1_.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\Windows\SysWOW64\net.exe
        net stop "Kingsoft AntiVirus Service"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2864
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
          4⤵
            PID:4280

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          $$a2040.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a2040.bat
          • Size 776B
          • SHA256 cad46e8a2a097383220207723c898bf31fbaac701b3e5c0663417d8ffef12cf2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a233E.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a233E.bat
          • Size 776B
          • SHA256 8f9b935c038c271149735fc2266ea21f2ee1c26bf8e68020587af138086af27d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a260C.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a260C.bat
          • Size 776B
          • SHA256 45a2dbe3c4bb6805a580df9cafefc26af6295a7a07709083803a32d63228e2a1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a27C2.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a27C2.bat
          • Size 776B
          • SHA256 0965b72090ea89a0794c277e22a2018ce20b4777db04ae5517bb0764741ca5ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a28EB.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a28EB.bat
          • Size 776B
          • SHA256 405061e47323e9a85672c2c6dbc6bc72c913866c0a07910b981e9d8767659be2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a2A42.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a2A42.bat
          • Size 776B
          • SHA256 e2ff311c7fb3f6e0dbbb8e43c5479e5edd5601ae9d18e35578dbdcbfd841662b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a2B4C.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a2B4C.bat
          • Size 776B
          • SHA256 6167cc8374f07a989b693927304d76fa8b42bb873e8c0570706747cbb6862d0b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a2C75.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a2C75.bat
          • Size 776B
          • SHA256 5bcb4a855f6a7a199a2908deafdadc60fd32d4755d625219aa85299c6dab00e6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a2D8E.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a2D8E.bat
          • Size 776B
          • SHA256 db02d68cdeb37b95935fca82c32fac3252955add03a2df21bb3a720be029222c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a2ED6.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a2ED6.bat
          • Size 776B
          • SHA256 6857c5c128acf77f4f0f8c86c01cb5867b8815402aa24b5005b93e11662b20ed
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a301E.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a301E.bat
          • Size 776B
          • SHA256 0b8e6460dec916564efbd050ed5571a548c12eb70522449f4b19798b84f0039b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a3167.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a3167.bat
          • Size 776B
          • SHA256 6e879f3c5d9812f6c844280c63c96f1fe959eb7ada2d355b16980de88a72148b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a3280.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a3280.bat
          • Size 776B
          • SHA256 d8d77dcde45a658e73335822c66f5e3b23cb13905c1aacd473ff81e690acdaee
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a3389.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a3389.bat
          • Size 776B
          • SHA256 743095a2b2e7297c2052e9230c7d0308623eadf8982056d4ff6c682922eaedf5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a34D2.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a34D2.bat
          • Size 776B
          • SHA256 39c2d0060ca0a2615e6c00c638bff51ecfb34ec9d40805a70b6d822495ee7cc0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a3B0B.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a3B0B.bat
          • Size 776B
          • SHA256 47018f6306dacb82006a8ed4ca323eeaa6b88e5189aa5add1733ba8f9a8720fe
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a3F70.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a3F70.bat
          • Size 776B
          • SHA256 1d868e47daf8dd209183a2629e25056cbb60907d183dcb25f7f3935e59b69cb1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a405B.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a405B.bat
          • Size 776B
          • SHA256 6a2f49923463e6dbc1c25664d64e08ba22a73a6308b0cef25aff4a2f7e973797
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a4164.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a4164.bat
          • Size 776B
          • SHA256 98f9a3d8adbe94fdbf9e8f18b8a5dcbeeb6f684ae121e0e2968768a28d991ed3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a44CF.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a44CF.bat
          • Size 776B
          • SHA256 721a7da0cb83984c12c582d8a4150486a9605096ca6609fdd4270869909df7b8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          $$a5421.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a5421.bat
          • Size 776B
          • SHA256 ebd68ebf2d370b3327db89406ed439dd13f9d88c3344ab27e69aec5e7aee78f4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 2.2MB
          • SHA256 199c9d93cc83f434700bfe2669e08a02ab4bd80dbd04b5849ce5c442a709ed51
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 2.1MB
          • SHA256 8c591fa2194bb3508101ac09cb8de4edffff35bb7ac5d2ab72eef1c9e9d08a53
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 2.0MB
          • SHA256 09d944632919b9558584b3f1a94290a7670b2c5a94a1eec8586f340a5589f2b9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 2.0MB
          • SHA256 82049b9d920722c7d798f7857a2bedc6d79572fc24df0df32734794871d95f86
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 1.9MB
          • SHA256 5dded6816597e2b2de6f64ccead08c4118868c8bae1554b2823f12f63070242f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 1.8MB
          • SHA256 0179eec7c18b50b9b8618d6832b6be08767329d5d350ae58ce0eab91aa41cd23
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 1.8MB
          • SHA256 7c8f3c161c708a0dbf4e6a735e10e4f460c52f7bd3f12fa274aa62b6a5fb093d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 1.7MB
          • SHA256 19be081e5f3d96c42f3c7fa7c6cb38fe232c238ea6e7aa5a291924ff7546bbd8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 1.7MB
          • SHA256 cd23dd7e8a2378cfe3b3e14baff995c9e79e7ea516a093d69ac675ca33d04d84
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 1.8MB
          • SHA256 705e1e419f699f3219f2fbf880d10510fb3edcbd7e996078df00b2899d3bbb3c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 1.7MB
          • SHA256 b3d1a9a8d26f876588ead5057a231be44f29cc0197a34941d453e9ccd1b7a9c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 2.3MB
          • SHA256 90148afddf6f0e15e64b8cd478f52f088bdd0294134506754061492a078a0964
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 2.3MB
          • SHA256 205dae4297dae1a0b6c56c57ee477e97dd416f3d2447f83f6efaa9e8555e0501
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 2.2MB
          • SHA256 76e3234f2989e27b137d0dba62587c7eb914f9360e015ff84860649f8b22bec9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 1.9MB
          • SHA256 b7192e937a80d40e13b27fd697c8c450b5b71a0d7c733cd5722fcbc627681b5f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 2.2MB
          • SHA256 de557d86661fa4e74e26df822ee529bd515cc608de1b61d30bc1a03a560c0f64
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 2.1MB
          • SHA256 d4abea2fca91355d993729cb242f4035e3a4bf5ae70caa3554545b53810251c1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 1.9MB
          • SHA256 3706cd63200f0bf4d7a38055f5874a7304e51b035c38d3ef2182c47c54f8eeb5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 2.1MB
          • SHA256 5332ec664a91595b74f4a450f71658085ccbe8d8d040d291e9438983995bc95e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-27_4407f4d3b6852f3a66266ae825914199_amadey_elex_smoke-loader_stop.exe.exe
          • Size 2.0MB
          • SHA256 9fb3139698f790905d8c5f4880195b8acfc9ee63947fde7a90cd9424be610cde
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Logo1_.exe
          • Path C:\Windows\Logo1_.exe
          • Size 32KB
          • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _desktop.ini
          • Path F:\$RECYCLE.BIN\S-1-5-21-3797332335-34111092-3597280141-1000\_desktop.ini
          • Size 9B
          • SHA256 c9c28af1bca9dd190c601086dbac674c55b098e242002181f7b73f846bb6240b
          • MD5 SHA1 SHA512
          Submit Download

          memory/260-56-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/432-80-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/548-8377-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/620-6183-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1004-127-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1080-119-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1268-8432-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1440-2487-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1764-6168-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1872-8343-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1892-5653-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/1992-33-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2192-8382-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2260-149-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2368-6173-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2408-6188-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2436-6178-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2496-8328-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2500-8417-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2604-92-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2672-0-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2672-13-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2788-72-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2792-104-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2792-10-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2792-2934-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2792-8366-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2796-5663-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2808-8360-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2852-1591-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/2972-135-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3012-5658-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3032-100-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3056-6149-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3316-5647-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3540-6139-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3636-23-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3668-8402-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3740-6134-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/3892-8397-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4052-1913-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4080-8392-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4116-8350-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4140-1921-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4196-8387-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4200-1929-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4216-8407-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4248-109-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4472-6144-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4544-8438-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4544-8433-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4552-8412-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4572-8367-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4572-8372-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4672-8355-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4776-7195-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/4928-6154-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/5216-8323-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/5304-8338-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/5468-8333-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/5528-42-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/5788-8422-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/5816-8365-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/5856-5668-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/5872-64-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/5984-6159-0x0000000000400000-0x0000000000445000-memory.dmp
          Download

          memory/6008-8427-0x0000000000400000-0x0000000000445000-memory.dmp
          Download