Overview

overview

7

Static

static

3

2026-09-27...op.exe

windows10-2004-x64

7

2026-09-27...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/09/2026, 03:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
  • Size 4.2MB
  • Sample260928-eec9ystw5p
  • SHA256 cbaa5ab93ab5e2a163e4a68d86fca90941cacb58a82c4fb7c6ea1f656d2d5604
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1140
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a309B.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4768
      • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5072
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a352F.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3204
          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:6116
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3723.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4720
              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5092
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3985.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:256
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2380
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BE6.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:1632
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:5688
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E28.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5528
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:1304
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a406A.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5752
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:5428
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a426E.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4256
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4368
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4491.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:3148
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:4732
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46F2.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:6112
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:3540
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CBF.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:2892
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:2096
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a529B.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4692
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4548
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54CD.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5372
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:6068
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a676B.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:124
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:596
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68E2.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4328
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1884
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AD6.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:6072
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2076
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E50.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:408
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2176
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FE7.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1828
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2336
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7219.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1820
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5164
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a740D.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5784
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:6108
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75B3.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1284
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2904
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7ECB.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:760
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5676
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FB5.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3116
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5560
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8071.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1956
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2056
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81A9.bat
                                                                                                      50⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:5800
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4044
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8294.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4556
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2736
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a839D.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3652
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5364
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8478.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1596
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3520
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a869B.bat
                                                                                                                      58⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3692
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1792
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8776.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2916
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:2420
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8822.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4332
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:2192
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88CE.bat
                                                                                                                                  64⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:2880
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:5408
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89A8.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:3084
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:3884
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A54.bat
                                                                                                                                          68⤵
                                                                                                                                            PID:4924
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:1108
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B2F.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:4460
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:2052
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BDB.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:5148
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:3120
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C96.bat
                                                                                                                                                        74⤵
                                                                                                                                                          PID:4404
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:5908
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D61.bat
                                                                                                                                                              76⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:4736
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5312
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DEE.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                    PID:2636
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:4104
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EAA.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:4144
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:1532
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F55.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:5552
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:2720
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9021.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:4772
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:624
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90CC.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:5836
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:4128
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9188.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                          PID:4712
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:4840
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9234.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                                PID:1476
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:4508
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92E0.bat
                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                      PID:1172
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:2404
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93AB.bat
                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:3588
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:5096
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9466.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:5820
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:4444
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9503.bat
                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:4560
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:2352
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a958F.bat
                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:3552
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:4620
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a962B.bat
                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:5196
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:3208
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96B8.bat
                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:5248
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:3044
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9783.bat
                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                    PID:3628
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:4852
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9810.bat
                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:4628
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:2576
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98AC.bat
                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:4608
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:5432
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9939.bat
                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                PID:5900
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:5596
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99C5.bat
                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:4812
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:2064
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A52.bat
                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:4056
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          PID:5804
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ADF.bat
                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:5224
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:1064
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BAA.bat
                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:5612
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:2764
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C65.bat
                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:548
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:5044
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D01.bat
                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                          PID:5508
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:5384
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D8E.bat
                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:5200
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:2732
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E2A.bat
                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:4684
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:1380
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EC7.bat
                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:4312
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:5124
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F53.bat
                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:5080
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:2452
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FFF.bat
                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                PID:3356
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                    PID:1100
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0CA.bat
                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:4416
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:4456
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA166.bat
                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                            PID:2324
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                                PID:2912
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1E3.bat
                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                    PID:2608
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:2020
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA29F.bat
                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:960
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:2004
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA32C.bat
                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                              PID:1992
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:1176
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3C8.bat
                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:1208
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:5416
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA483.bat
                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:2944
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        PID:3212
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA52F.bat
                                                                                                                                                                                                                                                                                                                                          150⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          PID:2164
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                              PID:2616
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5CB.bat
                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:5996
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:2888
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA658.bat
                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    PID:1544
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      PID:4352
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6F4.bat
                                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:2240
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:3256
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA771.bat
                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:5444
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5324
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7FE.bat
                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:2808
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    PID:2652
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA88B.bat
                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5700
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:3512
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA908.bat
                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:1148
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                              165⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:2472
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA994.bat
                                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3660
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                    167⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:2032
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA11.bat
                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:1456
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        PID:2296
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAAD.bat
                                                                                                                                                                                                                                                                                                                                                                                          170⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:3228
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:1348
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB2A.bat
                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:3192
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:5308
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABB7.bat
                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2116
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4032
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC53.bat
                                                                                                                                                                                                                                                                                                                                                                                                        176⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            177⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4748
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACE0.bat
                                                                                                                                                                                                                                                                                                                                                                                                              178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD5D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADEA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE67.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF03.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3500
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF8F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3832
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB02C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1424
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB145.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB23F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB339.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB462.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB56B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB617.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6C3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB76F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB888.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8F6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB963.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9F0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA5D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBADA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB57.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBE4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC70.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD99.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1556
                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                2⤵
                                                                                                                • Creates a file in the Startup directory
                                                                                                                • Executes dropped EXE
                                                                                                                • Enumerates connected drives
                                                                                                                • Drops file in Program Files directory
                                                                                                                • Drops file in Windows directory
                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5904
                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                  3⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4952
                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                    4⤵
                                                                                                                      PID:6128

                                                                                                              Network

                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                    Reconnaissance

                                                                                                                    Resource Development

                                                                                                                    Initial Access

                                                                                                                    Execution

                                                                                                                    Command and Scripting Interpreter

                                                                                                                    1
                                                                                                                    T1059

                                                                                                                    Windows Command Shell

                                                                                                                    1
                                                                                                                    T1059.003

                                                                                                                    Persistence

                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                    1
                                                                                                                    T1547

                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                    1
                                                                                                                    T1547.001

                                                                                                                    Privilege Escalation

                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                    1
                                                                                                                    T1547

                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                    1
                                                                                                                    T1547.001

                                                                                                                    Defense Evasion

                                                                                                                    Credential Access

                                                                                                                    Credentials from Password Stores

                                                                                                                    1
                                                                                                                    T1555

                                                                                                                    Credentials from Web Browsers

                                                                                                                    1
                                                                                                                    T1555.003

                                                                                                                    Unsecured Credentials

                                                                                                                    1
                                                                                                                    T1552

                                                                                                                    Credentials In Files

                                                                                                                    1
                                                                                                                    T1552.001

                                                                                                                    Discovery

                                                                                                                    Peripheral Device Discovery

                                                                                                                    1
                                                                                                                    T1120

                                                                                                                    Query Registry

                                                                                                                    1
                                                                                                                    T1012

                                                                                                                    System Information Discovery

                                                                                                                    1
                                                                                                                    T1082

                                                                                                                    System Location Discovery

                                                                                                                    1
                                                                                                                    T1614

                                                                                                                    System Language Discovery

                                                                                                                    1
                                                                                                                    T1614.001

                                                                                                                    System Network Configuration Discovery

                                                                                                                    1
                                                                                                                    T1016

                                                                                                                    Lateral Movement

                                                                                                                    Collection

                                                                                                                    Data from Local System

                                                                                                                    1
                                                                                                                    T1005

                                                                                                                    Command and Control

                                                                                                                    Exfiltration

                                                                                                                    Impact

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    $$a309B.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a309B.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 653c4f7db73169b677c2036eb1c5e67df62b73fea5ced5476c3cf60e13341691
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a352F.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a352F.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 6469cbb503af0a36f5c070e605d113e537ea365df99e66a4e70a2f20ba59e388
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a3723.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3723.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 ce75575e07346be6bc2eeb4aa3fb10a66e2ecfc98358838a74fcc6526872796b
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a3985.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3985.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 c5fdf7cda03116193018f40ebf840a26eb5cf888bccc7725dfb2e9bb78ba85c6
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a3BE6.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3BE6.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 0c1c63dbdb9415dc6b1fd16938be670455c5732e48959150298ec9348ffa11cc
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a3E28.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3E28.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 4abd2d59cfdd43e68433a0e959a75ecadb36f30ca5b9fc752119af0862fb531f
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a406A.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a406A.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 3d84368710f2cc64df83464b2e35ec0c507381284115c34ca7756c7537d8a594
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a426E.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a426E.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 46f7a226338d618a1d491a1288854f008afef68b776128778cf8c052671650e2
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a4491.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a4491.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 6dfeb793c27a414ed9efcd6bc225140559c202d3940bfcdb87e2c86153af061d
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a46F2.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a46F2.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 eecb293faf006fcabdf6fef7bc42d7f15a896284e6c94f110b9b5eb023519a4e
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a4CBF.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a4CBF.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 6b7f48128ced02e4279295373bbd1febadac8da9b98057815ba5313de7e6041e
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a529B.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a529B.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 19628bc33ebb5a2531045da2f095aec524b7ff073628a9d72141b061b6521898
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a54CD.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a54CD.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 178efc2eb720ef2227ef8fff4269dba20bbf49b223dd52331cc1485dfff49f95
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a676B.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a676B.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 5e35023a21a26639aaddccfff6291f95eac9b1cb54e8b236e1a8562448b5d3e6
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a68E2.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a68E2.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 a0941416fb7df1ce0ef3d9a98ae4a9d8fea7118371a57ae8bd25ed4c8a9a46c9
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a6AD6.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a6AD6.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 dbb35632148d5acda48e2031aa5ae6cde1b2875860b8633b8c892704ecb888a9
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a6E50.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a6E50.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 d61ce636ab8756141f06bbf7f87d9eb92702eda916d7ffae05425d2f61f632aa
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a6FE7.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a6FE7.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 54b85d388b046b6f74e1a95da5d41981860ab952e7ee8e3bde68083a6d53f928
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a7219.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a7219.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 00d70779406bc009ae94f5cf195fcae6a5f1811a48ea6b6a8cc1c3ee118f4632
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a740D.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a740D.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 954950559a8509607417f7f794b97fb75e41e77ed33f8bf84daa4625fbc003bf
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    $$a75B3.bat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a75B3.bat
                                                                                                                    • Size 776B
                                                                                                                    • SHA256 ddb0a8595b643fe87450d5cbfffbeeaaec2ed892486cd0d230cf7bd6e3c8b8d3
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 4.2MB
                                                                                                                    • SHA256 d6f45eb22b83794829e4a2efda4eff2b965459f42e6e2d5500e419d048cf1f62
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 4.1MB
                                                                                                                    • SHA256 30abd19a9e3406f3db91fb533a5fb02ee8a4b239b7ba560b9bf6bf103f220d70
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 4.1MB
                                                                                                                    • SHA256 6cedfd73dbfefa07a5358e88f435f986028b0f2fc0945a56e2a379769717d216
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.8MB
                                                                                                                    • SHA256 d208ec8a8e28ff3de5bad05d507398224ac43e82e8884319663932edae49a82d
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.7MB
                                                                                                                    • SHA256 f26acdc639bd4d6f608a72dd73f0108b5a4965fd794abe703d01e91fc87dda3a
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.6MB
                                                                                                                    • SHA256 a4c7fb0157b1fdc6ce94a68e4d4f192d0845ecad3474b63dc8264ad22713d809
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 4.0MB
                                                                                                                    • SHA256 77cab78005b282d706fd3867fc5ec7a2fca45cc09837a7159dd99c10577495a9
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.7MB
                                                                                                                    • SHA256 b1ff4a099f3ce2be69e0914e2e8c04780c100edd17a9244f4acca711cc643d1b
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 4.2MB
                                                                                                                    • SHA256 775d60b6cd95f2e84c60f140f7e1c5d761d477f335dc49e629315d9dbe90877c
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.9MB
                                                                                                                    • SHA256 c0212c6fe3982219f664331b104dc7c9f96b65fb367429ffdf0a9a6421cbfa43
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.7MB
                                                                                                                    • SHA256 4dc73b059e17f56e9c3b92a20ff213d6cd7525bd96ae0f0d0919b155cbedb743
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 4.2MB
                                                                                                                    • SHA256 28136a147d94219c211315c0e4278338a38c45937ed29ebaa258f2ec2e9b727b
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.9MB
                                                                                                                    • SHA256 c19c49048d12d32a4bea50911bcd7cdf1d957b70f76c8508251d1e85c220ddc4
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.6MB
                                                                                                                    • SHA256 3931d6d62dc7044a1f9034455b658a28c75f3d0527f44b78df5f007a5d738ba5
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 4.1MB
                                                                                                                    • SHA256 46042216368fb0169b976df4edb38c68800602b155ae8c9d85c5c207430276bc
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 4.0MB
                                                                                                                    • SHA256 3c34b03a120b744611e7c809b92dcff90d6a8963d59b791a3b39829bfd195ba2
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.9MB
                                                                                                                    • SHA256 d5b4103f8d33ef5cbe518ae7826cfa96ae5d6e635e3fc9bd80d64c47693ac4b9
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 4.0MB
                                                                                                                    • SHA256 2a2cb1e514dfe313723c27d976307789e5bccbf3a2f15f9589e0cf85ac6f303b
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.8MB
                                                                                                                    • SHA256 1e099f1a55b9e69936a2bb57d7c840f645d82a4636b600e1ae05eb184a07d069
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-27_81395440d734d8310e4e58363ec195e6_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                    • Size 3.8MB
                                                                                                                    • SHA256 84eb379c0240e12f041033fec2eb55d345df2b9811a3726d7755b9db0c25ffe5
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    Logo1_.exe
                                                                                                                    • Path C:\Windows\Logo1_.exe
                                                                                                                    • Size 32KB
                                                                                                                    • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    _desktop.ini
                                                                                                                    • Path F:\$RECYCLE.BIN\S-1-5-21-1704430598-3087477806-3297458608-1000\_desktop.ini
                                                                                                                    • Size 9B
                                                                                                                    • SHA256 918b1655c9319d78d9f5801608ae25b42e9cbb99cfe2671ee37ac122a938d764
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    memory/596-5599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/624-8359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1004-8676-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1064-8444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1100-8489-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1108-8319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1140-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1140-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1176-8519-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1252-8766-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1268-8646-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1304-76-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1348-8598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1380-8471-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1424-8658-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1532-8349-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1792-8294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1816-8796-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1876-8718-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1884-5607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2004-8513-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2020-8507-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2032-8586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2052-8324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2056-8267-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2064-8434-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2076-6076-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2096-1873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2176-6084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2192-8304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2204-8803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2204-8797-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2296-8592-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2336-6097-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2352-8394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2360-8730-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2364-8670-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2380-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2404-8379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2420-8299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2452-8483-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2472-8580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2576-8419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2616-8537-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2652-8568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2720-8354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2732-8465-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2736-8279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2764-8449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2844-8622-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2848-8754-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2888-8544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2904-8250-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2912-8501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2932-8682-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3044-8409-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3100-8736-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3120-8329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3208-8404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3212-8531-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3256-8556-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3336-8694-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3512-8574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3520-8289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3540-1556-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3792-8700-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3832-8652-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3884-8314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4032-8610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4044-8274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4084-8688-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4104-8344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4128-8364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4216-8706-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4260-8778-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4352-8550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4368-94-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4396-8790-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4444-8389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4456-8495-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4508-8374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4532-8628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4548-6092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4548-1881-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4588-8712-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4620-8399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4732-102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4748-8616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4840-8369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4852-8414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4868-8748-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5044-8454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5072-25-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5092-42-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5096-8384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5124-8477-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5164-6105-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5240-8634-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5308-8604-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5312-8339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5324-8562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5364-8284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5384-8459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5400-8772-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5408-8309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5416-8525-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5428-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5432-8424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5560-8262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5596-8429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5664-8742-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5676-8252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5676-8257-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5688-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5804-8439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5876-8784-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5904-303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5904-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5904-2424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5904-8251-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5908-8334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5920-8724-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/6008-8664-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/6068-5591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/6104-8760-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/6108-6113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/6116-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/6124-8640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                    Download