Overview

overview

7

Static

static

3

2026-09-24...op.exe

windows10-2004-x64

7

2026-09-24...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 04:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
  • Size 4.2MB
  • Sample260924-epv8hsdf85
  • SHA256 097f9ffd4c06bbe3c2af495480bb7dbd782487bdbb8ef714245c7842eddf7b79
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a670D.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5284
      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4716
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A0B.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2796
          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2536
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D18.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3940
              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:6072
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F2B.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4640
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4456
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a712F.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1908
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3888
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7303.bat
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:4652
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:4540
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7565.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5884
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:5704
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a773A.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:1244
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:4804
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a793D.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4916
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:3340
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B02.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:1636
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:5388
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E1F.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:5768
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:3240
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85FF.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:456
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3000
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87C4.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2304
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2984
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B8D.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:364
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4512
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B0D.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4180
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1280
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C84.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3692
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5268
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E88.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:480
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5712
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2AF.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:784
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2664
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA483.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4344
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3184
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6D5.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1212
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4120
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8B9.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4872
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3220
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB06A.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5940
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3108
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB116.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4144
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2228
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB200.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4388
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:752
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2AC.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4884
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3256
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB397.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3724
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:6056
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB462.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1028
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3020
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB50E.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2764
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:200
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5D9.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4260
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4764
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6A4.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4856
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:2568
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB740.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1204
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:5856
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB81B.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:1612
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:1604
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8B7.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:5040
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:2624
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB973.bat
                                                                                                                                            68⤵
                                                                                                                                              PID:4616
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4328
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA1F.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:4848
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4828
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAEA.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:976
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:6004
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB76.bat
                                                                                                                                                            74⤵
                                                                                                                                                              PID:1864
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:5576
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC22.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:5564
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:6064
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCCE.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:1252
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:5096
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD8A.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:5116
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:1932
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE35.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:1728
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:3164
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEC2.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:4524
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:2244
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF9D.bat
                                                                                                                                                                                      86⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:5368
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        87⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:3808
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC039.bat
                                                                                                                                                                                          88⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:5108
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:5320
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0D5.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:4256
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:548
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1A0.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:4104
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:3544
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC23D.bat
                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:844
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:2080
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2C9.bat
                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:5036
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:4348
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC356.bat
                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                PID:5920
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:2964
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC431.bat
                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:4748
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:1512
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4EC.bat
                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:3608
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:4820
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC579.bat
                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:5816
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:1596
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC605.bat
                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:940
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:5012
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6A2.bat
                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:1240
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:5324
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC71F.bat
                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:2744
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:5608
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7DA.bat
                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                              PID:2384
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:4880
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC876.bat
                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:5780
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:5948
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC922.bat
                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:4500
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:2340
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9CE.bat
                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:6020
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:2460
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA5B.bat
                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                PID:1188
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:5168
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB07.bat
                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                      PID:4740
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:2856
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBF1.bat
                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:1284
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:1480
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC9D.bat
                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:4796
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:1060
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD49.bat
                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  PID:3736
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                      PID:3092
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE14.bat
                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:4164
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                            PID:1476
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEC0.bat
                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:3472
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                  PID:3916
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF7B.bat
                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                      PID:5496
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:4972
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD046.bat
                                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:4308
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:5524
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD112.bat
                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:2600
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                                  PID:4528
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1AE.bat
                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                      PID:3712
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                        141⤵
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:2672
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD24A.bat
                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:1308
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:3844
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2F6.bat
                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:1416
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:3880
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD383.bat
                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:4124
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                      PID:4700
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD40F.bat
                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                          PID:4704
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                            149⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:1936
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4AB.bat
                                                                                                                                                                                                                                                                                                                                              150⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:5380
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                  PID:3900
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD548.bat
                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:4604
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      PID:4108
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5E4.bat
                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:2808
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                            PID:464
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD680.bat
                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:1288
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:4268
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD71C.bat
                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:4284
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2156
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7E8.bat
                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:3948
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2428
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD884.bat
                                                                                                                                                                                                                                                                                                                                                                              162⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4588
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                  163⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5844
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD930.bat
                                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:1960
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        PID:3920
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9DC.bat
                                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2652
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              167⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:3372
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA78.bat
                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:1080
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1324
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB33.bat
                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC2D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3160
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCF8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2556
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD75.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4112
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE02.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6040
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE7F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1000
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF3B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1988
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFB8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1044
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE035.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5220
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3640
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE16D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1EA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE267.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE41D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE555.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE66E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE71A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE797.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE824.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8A1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE91E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE99B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA18.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAC4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB50.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBCD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC4A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECA8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED25.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED92.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE1F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4572
                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                            C:\Windows\Logo1_.exe
                                                                                                            2⤵
                                                                                                            • Creates a file in the Startup directory
                                                                                                            • Executes dropped EXE
                                                                                                            • Enumerates connected drives
                                                                                                            • Drops file in Program Files directory
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2684
                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                              3⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5476
                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                4⤵
                                                                                                                  PID:5192

                                                                                                          Network

                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                Replay Monitor

                                                                                                                Loading Replay Monitor...

                                                                                                                Downloads

                                                                                                                $$a670D.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a670D.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 6ef699203adc4af1ae6c2d69d59b39a3aa0830fc677cec13d35f602961bfa7a5
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a6A0B.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6A0B.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 8f8727784e97654b3d0524b0688e838f998e7552775bda7eb7a21241afc70d22
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a6D18.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6D18.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 1e507a83234cd34f499ed9a258d09ff157c965b7c193ddacfbbad478acb6d665
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a6F2B.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6F2B.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 f70cb6a4ecae752f1858f68ad51a6a43c4f33fb5a9da861b13c9fb274245d413
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a712F.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a712F.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 6e5234a136ef8cf56e8166d1091d8b7ccc048e8abf0f654dd1a3deff58b5003f
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a7303.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a7303.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 d081f4691fd6dde5bb6df8cdb927bce85b121fba80e2025165fd8a39a0af090a
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a7565.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a7565.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 32f9fa430b718bbb256fcb3f4660a78591ff028cee6530a34ef0fee341c65221
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a773A.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a773A.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 37a1bdea371023ce6f070e0b16c7b07e634b6dbbc6a3f7236c11ae03a63c8192
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a793D.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a793D.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 a3c522033b239de46911404d35d18ed1ff808a29b8721f20c972cd05935e9e9e
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a7B02.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a7B02.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 0f0d385117704998a387aabfb652140e076f9f52077dc533bd9387fcbe3b5548
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a7E1F.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a7E1F.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 b7bf3e67c2043d1558d73c04598a709fe8f9e4bb8b37611c38312e6cf37506d8
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a85FF.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a85FF.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 a7a8ba5b69f2be7fa8f9607168680ae472179e7bda74d6046856fa9a8135c722
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a87C4.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a87C4.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 55a197505565e077fb06c753f69f0a2f8738032588c9b98cc9db23af8076a047
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a8B8D.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8B8D.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 feddc1d9774a25d2445120f84579bc47597529aabcb43cbe6b815eca9f98bd14
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a9B0D.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a9B0D.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 542efb67212d4bb5cf1415de754a4591d3f0bd42af5181542c8cc8b60d9f099a
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a9C84.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a9C84.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 d939e228ac3f1437e01ce2f15dfb546e7b0c08f59bd924794192f270d5a9eafb
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a9E88.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a9E88.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 8944d095fa2003a020220638fc2b56ae0a24461002ec3cfedbaa1eb0aa91a57d
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$aA2AF.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA2AF.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 1f91e28fbdd8b7fb4eed57cb6b5c4916fc8084f35c1d951597f76526a0a0bb1d
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$aA483.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA483.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 43c5fd481819743681283de0f3551cca81b4e2f6d0dc63d8ab341526089f0bf1
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$aA6D5.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA6D5.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 353b4e3275923d61770c9de1bf804cfc713f277abd6a4a0c473fca12bcd654e7
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$aA8B9.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA8B9.bat
                                                                                                                • Size 776B
                                                                                                                • SHA256 749c162d78f68230e5478459f36a1084dda707751980d4ce62a5bb3d43779b96
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 3.8MB
                                                                                                                • SHA256 40aadef1cda6adc428a53a4b74620088cec3192ff458c76f47b43ef4b5e8b811
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 3.7MB
                                                                                                                • SHA256 d10c6469f644449550e5faea798d95b22e6d65b00f3ff46ebcc4d5a3713759d6
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 3.6MB
                                                                                                                • SHA256 e56d6329e8c0fecc3b8ac21a70c37788c8e931b80f1105ff8a2b8efa5cfa816e
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 3.7MB
                                                                                                                • SHA256 93168c408dbecae87466dc0a7713bcf46fc3b711d0fc8d15d19cbee884c198e1
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 4.2MB
                                                                                                                • SHA256 c347a50d0dde4720e2a61ad6c1bc88559587022c6a0129f4a65d285e036ec2d3
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 3.8MB
                                                                                                                • SHA256 a26425f05aed0c77a373bb717244bce684020b42f6c24b77f48f898ed2492f82
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 3.6MB
                                                                                                                • SHA256 c265ab7499fa1ad2beb41cb1903aab2c900ae28aa39e0413e8f6eb0912feb6a7
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 4.2MB
                                                                                                                • SHA256 bc7d901677f7ba771727b7ba88ad3f7c4d8afe391b1906408fae5375604b2871
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 3.9MB
                                                                                                                • SHA256 fddb50f330b7b8091209e7e4c97ea52fd7ff07ccf56cfbd2de0a20bfb40cdec6
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 3.7MB
                                                                                                                • SHA256 057db27324fd2b19b0180a6815e927cfaeb21feb2876092c5b808759505fdd6a
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 4.1MB
                                                                                                                • SHA256 e9960ef4e2af5ad293e2d9ee876d3805a9e0435a3dc94eb35a693ea3fae23571
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 4.0MB
                                                                                                                • SHA256 bf5952c4cd7efc5459b7215f0f656fe4bc0ee5d23563a79923ad34829be60214
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 3.9MB
                                                                                                                • SHA256 22a48b424714c1d8edc2d643e9fbd9fc11cc348775f958cfa6d0d4e3d02efc37
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 4.0MB
                                                                                                                • SHA256 c32f1448e9d7d5ae389d7be49be600247a311b9896406f0a7a0d15c31b709855
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 3.8MB
                                                                                                                • SHA256 a8f2316e11ae9e0ece7ccc46ab42afe7e48805010d6b72fea6839c1d719b35e1
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 4.2MB
                                                                                                                • SHA256 2384fd0793a7d515b560d4e08444d3f2123900a8a578b2118bdd7f4ad00ee67d
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 4.1MB
                                                                                                                • SHA256 206252a3cf5842ced647c100b6221f3ec42d85cff3e20f435d9811b6ed3f798f
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 4.1MB
                                                                                                                • SHA256 4b0bf8387082ed6c84a9ecfecb1f9aff37f5bd27c1e10a16371f8af709a3e517
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 4.0MB
                                                                                                                • SHA256 4830d382cb4d914f40a1d0b5b12d1cf1855b8a22a727a97f3b89035a6b433922
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a845530755c2a58cb701767c54f48ce_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                • Size 3.9MB
                                                                                                                • SHA256 c7bc3432af0cb6dbc9bd58dcd3f5053bf72146ef10db617e307b274a723d46fe
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                Logo1_.exe
                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                • Size 32KB
                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                _desktop.ini
                                                                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-2304238888-3968896904-642854331-1000\_desktop.ini
                                                                                                                • Size 9B
                                                                                                                • SHA256 346de4d5debec31c9a445d77ea11610cbefd2c8caf903962fbf17b7ec8847d33
                                                                                                                • MD5 SHA1 SHA512
                                                                                                                Submit Download

                                                                                                                memory/200-8260-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/260-8683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/464-8520-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/476-8647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/548-8345-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/752-8236-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/772-8725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1000-8605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1060-8436-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1220-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1220-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1280-5607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1324-8562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1408-8653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1476-8448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1480-8430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1512-8370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1596-8380-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1604-8280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1852-8574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1932-8320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1936-8502-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1988-8611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2080-8355-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2124-8743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2148-8761-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2156-8532-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2228-8231-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2244-8330-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2308-8665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2340-8410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2364-8641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2428-8538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2460-8415-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2536-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2556-8587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2568-8270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2624-8285-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2648-8755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2664-6092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2672-8478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2684-8255-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2684-241-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2684-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2684-3329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2692-8677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2844-8593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2856-8425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2868-8659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2904-8731-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2964-8365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2984-2501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3000-1881-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3020-8254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3092-8442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3108-8226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3128-8568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3164-8325-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3184-6104-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3220-8221-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3240-1873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3256-8242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3340-102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3372-8556-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3380-8689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3444-8695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3544-8350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3640-8623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3808-8335-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3812-8713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3844-8484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3880-8490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3888-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3900-8508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3916-8454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3920-8550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4108-8514-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4120-6112-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4148-8617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4168-8737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4268-8526-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4328-8290-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4348-8360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4456-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4512-5599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4528-8472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4540-76-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4672-8671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4700-8496-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4716-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4764-8265-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4804-94-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4820-8375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4828-8295-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4880-8400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4912-8701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4972-8460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5012-8385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5060-8719-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5096-8315-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5168-8420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5192-8707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5268-5615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5268-8237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5312-8629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5320-8340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5324-8390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5328-8581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5388-246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5480-8768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5480-8774-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5524-8466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5576-8305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5608-8395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5636-8767-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5704-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5712-6084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5836-8635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5844-8544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5856-8275-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5948-8405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/6004-8300-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/6040-8599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/6056-8249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/6064-8310-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/6072-42-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/6116-8749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download