Overview

overview

7

Static

static

3

2026-09-24...op.exe

windows10-2004-x64

7

2026-09-24...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 04:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
  • Size 4.3MB
  • Sample260924-e2qtkaea33
  • SHA256 7dfc53b27006336aec1098d1b778c5c55a2671ef2da6e180b67ac0c314a1eeed
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E66.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:400
      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2672
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21C2.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1888
          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2336
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26B3.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:5400
              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:3340
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A4D.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4184
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:3380
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3039.bat
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2772
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:5212
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32C9.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1932
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:3312
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D87.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:5916
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:1152
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EB0.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3424
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4216
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4102.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3328
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:916
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52F4.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:3480
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:4320
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53FD.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:5224
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:3948
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a568D.bat
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5992
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1636
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AB4.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3176
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3696
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D06.bat
                                                          28⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4620
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5368
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F38.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4032
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1980
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61B9.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3052
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2500
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AD1.bat
                                                                      34⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5260
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2948
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C77.bat
                                                                          36⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4888
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5908
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EA9.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5216
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4068
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70FB.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3460
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4516
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72EF.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:6132
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2044
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74D3.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1828
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5296
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75AE.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4764
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5448
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a765A.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1948
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1884
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7725.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3404
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5844
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7800.bat
                                                                                                          52⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3368
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4440
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78DB.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3128
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2292
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7987.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4848
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4924
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A32.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3820
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:2880
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AEE.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:1264
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5996
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BA9.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:5568
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:4276
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CC3.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:4564
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:2220
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D8E.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:1628
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:4236
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E3A.bat
                                                                                                                                            68⤵
                                                                                                                                              PID:4520
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4908
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EF5.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:5748
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:1312
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FC0.bat
                                                                                                                                                      72⤵
                                                                                                                                                        PID:1272
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:5964
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a806C.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:5324
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:6112
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8128.bat
                                                                                                                                                                76⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:2084
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:3940
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8202.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                      PID:4128
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:5056
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82AE.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:4860
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:1400
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a835A.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:5048
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:1812
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8416.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                    PID:2932
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:3396
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84E1.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:2100
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:956
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a859C.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:5884
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:4140
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8687.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:3984
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:2372
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8723.bat
                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:1736
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:4264
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87CF.bat
                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:4784
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:4312
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a888A.bat
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:5564
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:5504
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8946.bat
                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:6032
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:472
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89E2.bat
                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:696
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:4612
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A8E.bat
                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:1372
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:1968
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B49.bat
                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:5372
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:4852
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C24.bat
                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:712
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:2236
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CD0.bat
                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                      PID:3180
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:356
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DAB.bat
                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                            PID:252
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:4492
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E47.bat
                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:4256
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:1916
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EF3.bat
                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:2700
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:4028
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FAE.bat
                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:1560
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:4468
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a905A.bat
                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                              PID:6128
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:3324
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9106.bat
                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                    PID:6028
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      PID:5424
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91A2.bat
                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:6036
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          PID:420
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a927D.bat
                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:5592
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              PID:3260
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9319.bat
                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:4896
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:1924
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95D9.bat
                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:4280
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:5732
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9684.bat
                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                          PID:4788
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:4740
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9740.bat
                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                PID:4796
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:964
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97EC.bat
                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:3744
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:6060
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98B7.bat
                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                          PID:1784
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                              PID:3364
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9972.bat
                                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:2488
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:1988
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A1E.bat
                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:2708
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:5764
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ACA.bat
                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                          PID:360
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                              PID:4200
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BA5.bat
                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:2532
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:5316
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C41.bat
                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                      PID:3692
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        PID:896
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CDD.bat
                                                                                                                                                                                                                                                                                                                                          148⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          PID:4060
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                            149⤵
                                                                                                                                                                                                                                                                                                                                              PID:824
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D89.bat
                                                                                                                                                                                                                                                                                                                                                150⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:2684
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                  151⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:1544
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E54.bat
                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2008
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        153⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:3836
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EF1.bat
                                                                                                                                                                                                                                                                                                                                                          154⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:5780
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6140
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F9D.bat
                                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:3680
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3140
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA068.bat
                                                                                                                                                                                                                                                                                                                                                                      158⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:2232
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                        159⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:6064
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA104.bat
                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5972
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                161⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:1456
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA191.bat
                                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:5348
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                    163⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:3412
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA21D.bat
                                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:5572
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4664
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2AA.bat
                                                                                                                                                                                                                                                                                                                                                                                            166⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:5352
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              167⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA365.bat
                                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3056
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA411.bat
                                                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA50B.bat
                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5D6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA682.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA71E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1216
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA895.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA951.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:788
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAA9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3236
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC9D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD29.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADD5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE81.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF2D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFD9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB085.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB140.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1EC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB288.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB305.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB44D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4F9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB586.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB632.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB76A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB826.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB95E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9DB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA68.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAF5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBA0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3704
                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                        C:\Windows\Logo1_.exe
                                                                                                        2⤵
                                                                                                        • Creates a file in the Startup directory
                                                                                                        • Executes dropped EXE
                                                                                                        • Enumerates connected drives
                                                                                                        • Drops file in Program Files directory
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1500
                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                          3⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4840
                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                            4⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:4580
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                      1⤵
                                                                                                        PID:5864

                                                                                                      Network

                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            $$a1E66.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a1E66.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 1a9f06bbfbe4ab2dee76da5dd9a80195276e1ecd83a7b9870deb3772bd7119d9
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a21C2.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a21C2.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 6a76b949893055c8f5057d616b32cc91eb4f658e1e7ec507d2abd72bd2925cec
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a26B3.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a26B3.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 78e1d52a9a165caafb9a4bcbb16a949814f9a4d6c0b7b1c42e2ff2aa7f52a544
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a2A4D.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a2A4D.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 685ba80ceef7d8c4338890d8b101c7f8d0099274d42a6f9d5715e73e88b1ff66
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a3039.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a3039.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 cf63504f1112c23009b9d47e3363ae3f8f967afcd3f9c32b6f90904e3c309afe
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a32C9.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a32C9.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 c0d84b522b641bb1f3924448317497f8a57d56acf9820dd9427217c4f6d7ec0b
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a3D87.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a3D87.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 4179a290fc16ad94ae3520b41c46f37089439003ffb6c74dd18044d9c6d917d0
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a3EB0.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a3EB0.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 d3cc7b7a83ec5a984476df2aa3a9169bc9efec29421dfb040a25f53a69860048
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a4102.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a4102.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 1486ce09a4829d97d75bc3f2c900c93446f38a16c70c06a2199e2e155d781fa5
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a52F4.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a52F4.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 382f48f7db4896f1430569127c51e0bb046f847c7550c7897c4f56a0219fab7e
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a53FD.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a53FD.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 e879f0e5a24417d75a522927c18cdc8f1d9797a1d34b7551f5fb29fd4457eb79
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a568D.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a568D.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 aff8d3571e92cee591469f4c592768cfd49cf22b91b01826f76d25b06440fdc0
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a5AB4.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a5AB4.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 d1595865dc031ec5769e91960d039c0d5533583ceeb9218af201760233e46d85
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a5D06.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a5D06.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 1a8b76d039720557e9d6ea2a3abf1d5f0b45f61e936bc87aedd247f2bfd5965f
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a5F38.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a5F38.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 f2ea78a214ce5045cb7087e539d088f11f47c9d7e46f1adb2044128dc391dfa4
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a61B9.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a61B9.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 fbc753be1431bb19a83375bc77e75024dd99739c42af3172c337426488c34b94
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a6AD1.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a6AD1.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 5686a1f63ca8e6cc2d704c9d4eb5793361b63d70d901329e56dc5754539b0f85
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a6C77.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a6C77.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 0e65db5d17fce3888d455233c4c9762e5b30f3a344081050171ba37476b149af
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a6EA9.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a6EA9.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 2e8a3584ca18911e84610174057e81cd56d7bff34346f14b70f648849ef8327b
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a70FB.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a70FB.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 edf7a204aca5386c3574473e820baf83ed1fddd9f47994a79330d365b39b9324
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            $$a72EF.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a72EF.bat
                                                                                                            • Size 776B
                                                                                                            • SHA256 37575629143e4f60563afc46720960cba430437bbc566bdbaad1aee3e9e19088
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 4.2MB
                                                                                                            • SHA256 097f9ffd4c06bbe3c2af495480bb7dbd782487bdbb8ef714245c7842eddf7b79
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 4.2MB
                                                                                                            • SHA256 c347a50d0dde4720e2a61ad6c1bc88559587022c6a0129f4a65d285e036ec2d3
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 4.2MB
                                                                                                            • SHA256 2384fd0793a7d515b560d4e08444d3f2123900a8a578b2118bdd7f4ad00ee67d
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 4.2MB
                                                                                                            • SHA256 bc7d901677f7ba771727b7ba88ad3f7c4d8afe391b1906408fae5375604b2871
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 4.1MB
                                                                                                            • SHA256 e9960ef4e2af5ad293e2d9ee876d3805a9e0435a3dc94eb35a693ea3fae23571
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 4.0MB
                                                                                                            • SHA256 c32f1448e9d7d5ae389d7be49be600247a311b9896406f0a7a0d15c31b709855
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.9MB
                                                                                                            • SHA256 fddb50f330b7b8091209e7e4c97ea52fd7ff07ccf56cfbd2de0a20bfb40cdec6
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.7MB
                                                                                                            • SHA256 057db27324fd2b19b0180a6815e927cfaeb21feb2876092c5b808759505fdd6a
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 4.0MB
                                                                                                            • SHA256 bf5952c4cd7efc5459b7215f0f656fe4bc0ee5d23563a79923ad34829be60214
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.9MB
                                                                                                            • SHA256 22a48b424714c1d8edc2d643e9fbd9fc11cc348775f958cfa6d0d4e3d02efc37
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.8MB
                                                                                                            • SHA256 a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.7MB
                                                                                                            • SHA256 d10c6469f644449550e5faea798d95b22e6d65b00f3ff46ebcc4d5a3713759d6
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.8MB
                                                                                                            • SHA256 a8f2316e11ae9e0ece7ccc46ab42afe7e48805010d6b72fea6839c1d719b35e1
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 4.1MB
                                                                                                            • SHA256 4b0bf8387082ed6c84a9ecfecb1f9aff37f5bd27c1e10a16371f8af709a3e517
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.8MB
                                                                                                            • SHA256 40aadef1cda6adc428a53a4b74620088cec3192ff458c76f47b43ef4b5e8b811
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 4.0MB
                                                                                                            • SHA256 4830d382cb4d914f40a1d0b5b12d1cf1855b8a22a727a97f3b89035a6b433922
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.7MB
                                                                                                            • SHA256 93168c408dbecae87466dc0a7713bcf46fc3b711d0fc8d15d19cbee884c198e1
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.9MB
                                                                                                            • SHA256 c7bc3432af0cb6dbc9bd58dcd3f5053bf72146ef10db617e307b274a723d46fe
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 3.6MB
                                                                                                            • SHA256 c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_0fd2809255ce9147856ccee24c659214_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                            • Size 4.1MB
                                                                                                            • SHA256 206252a3cf5842ced647c100b6221f3ec42d85cff3e20f435d9811b6ed3f798f
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            Logo1_.exe
                                                                                                            • Path C:\Windows\Logo1_.exe
                                                                                                            • Size 32KB
                                                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            _desktop.ini
                                                                                                            • Path F:\$RECYCLE.BIN\S-1-5-21-4154726816-2055034831-2297277433-1000\_desktop.ini
                                                                                                            • Size 9B
                                                                                                            • SHA256 346de4d5debec31c9a445d77ea11610cbefd2c8caf903962fbf17b7ec8847d33
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            memory/356-8298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/420-8333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/472-8273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/788-8525-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/824-8411-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/896-8405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/916-5561-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/956-8243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/964-8363-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1084-8465-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1100-8489-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1152-1841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1216-8507-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1228-8627-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1312-8203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1340-8651-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1400-8228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1408-8609-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1456-8447-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1468-8537-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1500-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1500-1060-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1500-8106-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1500-3002-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1544-8417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1636-6046-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1708-8483-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1812-8233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1884-8148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1916-8308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1924-8345-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1968-8283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1980-6070-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1980-6075-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/1988-8381-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2040-8639-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2044-8133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2116-8681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2220-8188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2236-8293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2292-8163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2336-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2372-8253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2436-8657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2472-8633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2500-8092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2644-8689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2644-8683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2672-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2804-8591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2880-8173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2888-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2888-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2928-8585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/2948-8100-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3012-8669-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3140-8435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3248-8579-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3260-8338-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3312-1833-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3324-8323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3340-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3364-8375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3380-62-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3396-8238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3412-8453-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3648-8675-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3696-6054-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3720-8615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3804-8561-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3836-8423-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3940-8218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3948-5577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3968-8555-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3972-8543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4028-8313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4068-8119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4140-8248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4200-8393-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4204-8531-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4216-1849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4236-8193-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4240-8477-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4264-8258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4268-8573-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4276-8183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4312-8263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4320-5569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4372-8621-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4440-8158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4468-8318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4492-8303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4516-8127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4580-8567-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4612-8278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4664-8459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4740-8357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4852-8288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4908-8198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4924-8168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4936-8645-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/4984-8663-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5056-8223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5212-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5280-8513-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5296-8138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5316-8399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5328-8495-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5368-6066-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5404-8519-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5424-8328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5448-8143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5504-8268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5548-8501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5732-8351-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5764-8387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5792-8549-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5844-8153-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5908-8111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5944-8597-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5960-8471-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5964-8208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/5996-8178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6060-8369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6064-8441-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6100-8603-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6112-8213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6140-8429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                            Download